Caller check in execute_on_plugin

[NIC619]

There's assert_only_self check in add_plugin and remove_plugin functions. And according to README, it also says that execute_on_plugin can only be called from the wallet:

Changing the state of a plugin

To manipulate the state of a plugin, the account has a executeOnPlugin that can be only called from the wallet

But there doesn't seem to be an assert_only_self check in executeOnPlugin. Am I missing something or is there a reason why it does not need an assert_only_self check?

[CremaFR]

The reason is that executeOnPlugin is used to call any method on a plugin and those methods manages the caller check.
You can see this In StarkSigner and SessionKey.

This method then can be called by other contracts to access the publicKey on your account by using executeOnPlugin to call StarkSigner's getPublicKey method

At one time we had both executeOnPlugin and ReadOnPlugin to make this distinction between read/write and had checks on executeOnPlugin but since @view doesn't enforce the non state mutability it created issues where you could "read" setPublicKey and take control of an account.

Maybe a rename could be appropriate to show that this method can do both read and write to avoid confusions

[NIC619]

Thanks for the info! TIL @view does not enforce non state mutability...
👍 on rename or updating the doc. It would be helpful IMO.