rework

acceptance-tests/src/test/java/tech/pegasys/pantheon/tests/acceptance/permissioning/NodeLocalAndOnChainPermissioningAcceptanceTest.java

@@ -0,0 +1,113 @@
+/*
+ * Copyright 2019 ConsenSys AG.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package tech.pegasys.pantheon.tests.acceptance.permissioning;
+
+import tech.pegasys.pantheon.tests.acceptance.dsl.node.Node;
+
+import org.junit.Before;
+import org.junit.Test;
+
+public class NodeLocalAndOnChainPermissioningAcceptanceTest
+    extends NodeSmartContractPermissioningAcceptanceTestBase {
+
+  private Node bootnode;
+  private Node permissionedNode;
+  private Node allowedNode;
+  private Node forbiddenNode;
+
+  @Before
+  public void setUp() {
+    bootnode = bootnode("bootnode");
+    forbiddenNode = node("forbidden-node");
+    allowedNode = node("allowed-node");
+
+    permissionedCluster.start(bootnode, allowedNode, forbiddenNode);
+  }
+
+  @Test
+  public void testNodeCannotConnectWhenWhiteListedOnChainButNotLocal() {
+
+    // add permissioned node after cluster start because we need enode URI for local config
+    permissionedNode = permissionedNode("permissioned-node", bootnode, allowedNode);
+    permissionedCluster.addNode(permissionedNode);
+
+    // update OnChain smart contract with allowed nodes
+    permissionedNode.execute(allowNode(bootnode));
+    permissionedNode.verify(nodeIsAllowed(bootnode));
+
+    permissionedNode.execute(allowNode(allowedNode));
+    permissionedNode.verify(nodeIsAllowed(allowedNode));
+
+    permissionedNode.execute(allowNode(permissionedNode));
+    permissionedNode.verify(nodeIsAllowed(permissionedNode));
+
+    permissionedNode.execute(allowNode(forbiddenNode));
+    permissionedNode.verify(nodeIsAllowed(forbiddenNode));
+
+    permissionedNodeShouldDiscoverOnlyAllowedNodes();
+  }
+
+  @Test
+  public void testNodeCannotConnectWhenWhitelistedLocalButNotOnChain() {
+    // onchain whitelist: A, B
+    // local whitelist: A, B, C
+
+    // add permissioned node after cluster start because we need enode URI for local config
+    permissionedNode = permissionedNode("permissioned-node", bootnode, allowedNode, forbiddenNode);
+    permissionedCluster.addNode(permissionedNode);
+
+    // update OnChain smart contract with allowed nodes
+    permissionedNode.execute(allowNode(bootnode));
+    permissionedNode.verify(nodeIsAllowed(bootnode));
+
+    permissionedNode.execute(allowNode(allowedNode));
+    permissionedNode.verify(nodeIsAllowed(allowedNode));
+
+    permissionedNode.execute(allowNode(permissionedNode));
+    permissionedNode.verify(nodeIsAllowed(permissionedNode));
+
+    permissionedNodeShouldDiscoverOnlyAllowedNodes();
+  }
+
+  @Test
+  public void testNodesCanConnectWhenWhitelistedBothOnChainAndLocal() {
+    // add permissioned node after cluster start because we need enode URI for local config
+    permissionedNode = permissionedNode("permissioned-node", bootnode, allowedNode, forbiddenNode);
+    permissionedCluster.addNode(permissionedNode);
+
+    // update OnChain smart contract with allowed nodes
+    permissionedNode.execute(allowNode(bootnode));
+    permissionedNode.verify(nodeIsAllowed(bootnode));
+
+    permissionedNode.execute(allowNode(allowedNode));
+    permissionedNode.verify(nodeIsAllowed(allowedNode));
+
+    permissionedNode.execute(allowNode(permissionedNode));
+    permissionedNode.verify(nodeIsAllowed(permissionedNode));
+
+    permissionedNode.execute(allowNode(forbiddenNode));
+    permissionedNode.verify(nodeIsAllowed(forbiddenNode));
+
+    bootnode.verify(net.awaitPeerCount(3));
+    allowedNode.verify(net.awaitPeerCount(3));
+    forbiddenNode.verify(net.awaitPeerCount(3));
+    permissionedNode.verify(net.awaitPeerCount(3));
+  }
+
+  private void permissionedNodeShouldDiscoverOnlyAllowedNodes() {
+    bootnode.verify(net.awaitPeerCount(3));
+    allowedNode.verify(net.awaitPeerCount(3));
+    forbiddenNode.verify(net.awaitPeerCount(2));
+    permissionedNode.verify(net.awaitPeerCount(2));
+  }
+}

acceptance-tests/src/test/java/tech/pegasys/pantheon/tests/acceptance/permissioning/NodeSmartContractPermissioningAcceptanceTestBase.java

@@ -20,6 +20,7 @@
 import tech.pegasys.pantheon.tests.acceptance.dsl.node.cluster.Cluster;
 import tech.pegasys.pantheon.tests.acceptance.dsl.node.cluster.ClusterConfiguration;
 import tech.pegasys.pantheon.tests.acceptance.dsl.node.cluster.ClusterConfigurationBuilder;
+import tech.pegasys.pantheon.tests.acceptance.dsl.node.configuration.permissioning.PermissionedNodeBuilder;
 import tech.pegasys.pantheon.tests.acceptance.dsl.transaction.Transaction;
 import tech.pegasys.pantheon.tests.acceptance.dsl.transaction.perm.NodeSmartContractPermissioningTransactions;
 
@@ -49,12 +50,16 @@ private Cluster permissionedCluster() {
     return new Cluster(clusterConfiguration, net);
   }
 
-  protected Node permissionedNode(final String name) {
-    return permissionedNodeBuilder
-        .name(name)
-        .genesisFile(GENESIS_FILE)
-        .nodesContractEnabled(CONTRACT_ADDRESS)
-        .build();
+  protected Node permissionedNode(final String name, final Node... localConfigWhiteListedNodes) {
+    PermissionedNodeBuilder permissionedNodeBuilder =
+        this.permissionedNodeBuilder
+            .name(name)
+            .genesisFile(GENESIS_FILE)
+            .nodesContractEnabled(CONTRACT_ADDRESS);
+    if (localConfigWhiteListedNodes != null && localConfigWhiteListedNodes.length > 0) {
+      permissionedNodeBuilder.nodesPermittedInConfig(localConfigWhiteListedNodes);
+    }
+    return permissionedNodeBuilder.build();
   }
 
   protected Node bootnode(final String name) {

docs/Installation/Overview.md

@@ -12,7 +12,4 @@ You can install Pantheon by:
 !!! note 
     To run a single node to connect the Ethereum mainnet or a public testnet, running from the [Pantheon docker image](../Getting-Started/Run-Docker-Image.md) is the fastest way to get started.
 
-## Disk Space and RAM Requirements
-Your computer should have at least 4 GB RAM if running a private network, and 8GB of RAM if running mainnet or a public test network. 
 
-Disk space needed varies depending on the network on which you run nodes. A small test network might require 200 MB while a mainnet node might require 1.5TB. If syncing a node on mainnet, allow 1.5 TB to 2 TB for the full blockchain archive.

docs/Installation/System-Requirements.md

@@ -0,0 +1,29 @@
+title: System Requirements
+description: System requirements to sync and run Pantheon 
+<!--- END of page meta data -->
+
+# System Requirements 
+
+The system requirements for Pantheon depend on a number of factors: 
+
+* Size of the world state for the network
+* Number of transactions submitted to network 
+* Block gas limit 
+* Number and complexity of [JSON-RPC](../Pantheon-API/Using-JSON-RPC-API.md), [PubSub](../Pantheon-API/RPC-PubSub.md), 
+or [GraphQL](../Pantheon-API/GraphQL.md) queries being handled by the node 
+
+## Determining System Requirements  
+
+To determine system requirements, monitor CPU and disk space requirements using [Prometheus](https://docs.pantheon.pegasys.tech/en/stable/Monitoring/Monitoring-Performance/#monitor-node-performance-using-prometheus). 
+A sample [Grafana dashboard](https://grafana.com/grafana/dashboards/10273) is provided for Pantheon. 
+
+!!! tip
+    CPU requirements are highest when syncing to the network and typically reduce once the node is synchronized to the chain head. 
+
+## RAM 
+
+Pantheon requires 4GB of RAM. For Ethereum Mainnet, a minimum of 8GB of RAM is required 
+
+## Disk Space 
+
+Syncing to the Ethereum mainnet requires 3TB for a full sync. 

docs/Privacy/How-To/Creating-Sending-Private-Transactions.md

@@ -3,34 +3,11 @@ description: Creating and sending private transactions
 
 # Creating and Sending Private Transactions 
 
-Create and send private transactions using: 
+To create and send private transactions use one of: 
 
-* [web3.js-eea client library](eeajs.md) or [web3j client library](https://github.com/web3j/web3j)
+* [web3.js-eea client library](eeajs.md)
 * [`eea_sendTransaction` with EthSigner](https://docs.ethsigner.pegasys.tech/en/latest/Using-EthSigner/Using-EthSigner/) 
-* [`eea_sendRawTransaction`](../../Reference/Pantheon-API-Methods.md#eea_sendrawtransaction) 
 
 !!! note
     Private transactions either deploy contracts or call contract functions. 
-    Ether transfer transactions cannot be private. 
-
-## Methods for Private Transactions
-
-A private transaction creates a [Privacy Marker Transaction](../Private-Transaction-Processing.md) in addition to the private transaction itself. 
-Use [`eth_getTransactionReceipt`](../../Reference/Pantheon-API-Methods.md#eth_gettransactionreceipt) to 
-get the transaction receipt for the Privacy Maker Transaction and [`eea_getTransactionReceipt`](../../Reference/Pantheon-API-Methods.md#eea_gettransactionreceipt) 
-to get the transaction receipt for the private transaction. 
-
-Use [`eth_getTransactionByHash`](../../Reference/Pantheon-API-Methods.md#eth_gettransactionbyhash) to 
-get the Privacy Marker Transaction with the transaction hash returned when submitting the private transaction. 
-Use [`eea_getPrivateTransacton`](../../Reference/Pantheon-API-Methods.md#eea_getprivatetransaction) 
-to get the private transaction with the `input` value from the Privacy Marker Transaction. 
-
-Separate private states are maintained for each [privacy group](../Privacy-Overview.md#privacy-groups) so 
-the account nonce for an account is specific to the privacy group. That is, the nonce for account A for
-privacy group ABC is different to the account nonce for account A for privacy group AB. Use 
-[`eea_getTransactionCount`](../../Reference/Pantheon-API-Methods.md#eea_gettransactioncount) to get 
-the account nonce for an account for the specified privacy group. 
-
-!!! note
-    If sending a large number of private transactions, you may need to calculate the nonce for the account 
-    and privacy group outside the client. 
+    Ether transfer transactions cannot be private. 

docs/Reference/Pantheon-API-Methods.md

@@ -3771,6 +3771,113 @@ None
     The `EEA` API methods are not enabled by default for JSON-RPC. Use the [`--rpc-http-api`](Pantheon-CLI-Syntax.md#rpc-http-api) 
     or [`--rpc-ws-api`](Pantheon-CLI-Syntax.md#rpc-ws-api) options to enable the `EEA` API methods.
 
+### eea_createPrivacyGroup 
+
+Creates a privacy group containing the specified members. Members are specified by their Orion public key. 
+
+**Parameters** 
+
+`data` - Orion public key of privacy group creator 
+
+`string` - Privacy group name. Optional. 
+
+`string` - Privacy group description. Optional. 
+
+`array of data` - Array of members specified by Orion public keys 
+
+**Returns** 
+
+Privacy group ID 
+
+!!! example
+    ```bash tab="curl HTTP request"
+    curl -X POST --data '{"jsonrpc":"2.0","method":"eea_createPrivacyGroup","params":["negmDcN2P4ODpqn/6WkJ02zT/0w0bjhGpkZ8UP6vARk=", "Group A", "Description Group A", ["negmDcN2P4ODpqn/6WkJ02zT/0w0bjhGpkZ8UP6vARk=","g59BmTeJIn7HIcnq8VQWgyh/pDbvbt2eyP0Ii60aDDw="]],"id":1}' http://127.0.0.1:8545
+    ```
+
+    ```bash tab="wscat WS request"
+    {"jsonrpc":"2.0","method":"eea_createPrivacyGroup","params":["negmDcN2P4ODpqn/6WkJ02zT/0w0bjhGpkZ8UP6vARk=", "Group A", "Description Group A", ["negmDcN2P4ODpqn/6WkJ02zT/0w0bjhGpkZ8UP6vARk=","g59BmTeJIn7HIcnq8VQWgyh/pDbvbt2eyP0Ii60aDDw="]],"id":1}
+    ```
+
+    ```json tab="JSON result"
+    {
+      "jsonrpc": "2.0",
+      "id": 1,
+      "result": "ewuTVoc5nlvWMwTFdRRK/wvV0dcyQo/Pauvx5bNEbTk="
+    }
+    ``` 
+
+### eea_deletePrivacyGroup
+
+Deletes the specified privacy group. 
+
+**Parameters** 
+
+`data` - Orion public key of privacy group deleter 
+
+`data` - Privacy group ID 
+
+**Returns** 
+
+Privacy group ID 
+
+!!! example
+    ```bash tab="curl HTTP request"
+    curl -X POST --data '{"jsonrpc":"2.0","method":"eea_deletePrivacyGroup","params":["negmDcN2P4ODpqn/6WkJ02zT/0w0bjhGpkZ8UP6vARk=", "ewuTVoc5nlvWMwTFdRRK/wvV0dcyQo/Pauvx5bNEbTk="],"id":1}' http://127.0.0.1:8545
+    ```
+
+    ```bash tab="wscat WS request"
+    {"jsonrpc":"2.0","method":"eea_deletePrivacyGroup","params":["negmDcN2P4ODpqn/6WkJ02zT/0w0bjhGpkZ8UP6vARk=", "ewuTVoc5nlvWMwTFdRRK/wvV0dcyQo/Pauvx5bNEbTk="],"id":1}
+    ```
+
+    ```json tab="JSON result"
+    {
+      "jsonrpc": "2.0",
+      "id": 53,
+      "result": "ewuTVoc5nlvWMwTFdRRK/wvV0dcyQo/Pauvx5bNEbTk="
+    }
+    ```
+
+### eea_findPrivacyGroup
+
+Returns a list of privacy groups containing only the listed members. For example, if the listed members 
+are A and B, a privacy group containing A, B, and C is not returned. 
+
+**Parameters** 
+
+`array of data` - Members specified by Orion public keys 
+
+**Returns** 
+
+Privacy groups containing only the specified members. 
+
+!!! example
+    ```bash tab="curl HTTP request"
+    curl -X POST --data '{"jsonrpc": "2.0","method": "eea_findPrivacyGroup","params": [["negmDcN2P4ODpqn/6WkJ02zT/0w0bjhGpkZ8UP6vARk=", "g59BmTeJIn7HIcnq8VQWgyh/pDbvbt2eyP0Ii60aDDw="]],"id": 1}' http://127.0.0.1:8545
+    ```
+
+    ```bash tab="wscat WS request"
+    {"jsonrpc": "2.0","method": "eea_findPrivacyGroup","params": [["negmDcN2P4ODpqn/6WkJ02zT/0w0bjhGpkZ8UP6vARk=", "g59BmTeJIn7HIcnq8VQWgyh/pDbvbt2eyP0Ii60aDDw="]],"id": 1}
+    ```
+
+    ```json tab="JSON result"
+    {
+      "jsonrpc": "2.0",
+      "id": 1,
+      "result": [
+         {
+           "privacyGroupId": "GpK3ErNO0xF27T0sevgkJ3+4qk9Z+E3HtXYxcKIBKX8=",
+           "name": "Group B",
+           "description": "Description of Group B",
+           "type": "PANTHEON",
+           "members": [
+             "negmDcN2P4ODpqn/6WkJ02zT/0w0bjhGpkZ8UP6vARk=",
+             "g59BmTeJIn7HIcnq8VQWgyh/pDbvbt2eyP0Ii60aDDw="
+           ]
+         }
+      ]
+    }
+    ```
+
 ### eea_sendRawTransaction
 
 Creates a private transaction from a signed transaction, generates the transaction hash and submits it 

docs/Using-Pantheon/Account-Management.md

@@ -13,7 +13,7 @@ In Pantheon, you can use the JSON-RPC methods:
 
  * [`eth_getBalance`](../Reference/Pantheon-API-Methods.md#eth_getbalance) to obtain the account balance
  * [`eth_sendRawTransaction`](../Reference/Pantheon-API-Methods.md#eth_sendrawtransaction) to transfer ether or create and interact with contracts (for more information, refer to [Transactions](Transactions/Transactions.md#transactions)).  
- * [`eea_sendRawTransaction`](../Reference/Pantheon-API-Methods.md#eea_sendrawtransaction) to send [private transactions](../Privacy/Private-Transactions/Creating-Sending-Private-Transactions.md).
+ * [`eea_sendRawTransaction`](../Reference/Pantheon-API-Methods.md#eea_sendrawtransaction) to send [private transactions](../Privacy/How-To/Creating-Sending-Private-Transactions.md).
 
 !!! tip 
     [EthSigner](http://docs.ethsigner.pegasys.tech/en/latest/) implements [`eth_sendTransaction`](http://docs.ethsigner.pegasys.tech/en/latest/Using-EthSigner/Using-EthSigner/#eth_sendtransaction)

mkdocs.yml

@@ -57,6 +57,7 @@ nav:
         - Installation Overview: Installation/Overview.md
         - Install Binary Distribution: Installation/Install-Binaries.md
         - Build from Source: Installation/Build-From-Source.md
+        - System Requirements: Installation/System-Requirements.md
     - Architecture:
         - Overview: Architecture/Overview.md
     - Getting Started: