security admin can move openbook market to reduce only (#472)

* security admin can move openbook market to reduce only

Signed-off-by: microwavedcola1 <microwavedcola@gmail.com>

* Fixes from review

Signed-off-by: microwavedcola1 <microwavedcola@gmail.com>

---------

Signed-off-by: microwavedcola1 <microwavedcola@gmail.com>

programs/mango-v4/src/accounts_ix/serum3_edit_market.rs

@@ -6,7 +6,7 @@ use crate::state::*;
 #[instruction(market_index: Serum3MarketIndex)]
 pub struct Serum3EditMarket<'info> {
     #[account(
-        has_one = admin,
+        // group <-> admin relation is checked at #1
         constraint = group.load()?.serum3_supported()
     )]
     pub group: AccountLoader<'info, Group>,

programs/mango-v4/src/instructions/serum3_edit_market.rs

@@ -1,4 +1,4 @@
-use crate::accounts_ix::*;
+use crate::{accounts_ix::*, error::MangoError};
 use anchor_lang::prelude::*;
 
 pub fn serum3_edit_market(
@@ -7,6 +7,9 @@ pub fn serum3_edit_market(
 ) -> Result<()> {
     let mut serum3_market = ctx.accounts.market.load_mut()?;
 
+    let group = ctx.accounts.group.load()?;
+    let mut require_group_admin = false;
+
     if let Some(reduce_only) = reduce_only_opt {
         msg!(
             "Reduce only: old - {:?}, new - {:?}",
@@ -14,6 +17,25 @@ pub fn serum3_edit_market(
             u8::from(reduce_only)
         );
         serum3_market.reduce_only = u8::from(reduce_only);
+
+        // security admin can only enable reduce_only
+        if !reduce_only {
+            require_group_admin = true;
+        }
     };
+
+    if require_group_admin {
+        require!(
+            group.admin == ctx.accounts.admin.key(),
+            MangoError::SomeError
+        );
+    } else {
+        require!(
+            group.admin == ctx.accounts.admin.key()
+                || group.security_admin == ctx.accounts.admin.key(),
+            MangoError::SomeError
+        );
+    }
+
     Ok(())
 }