First, I'm aware of a similar question, but that answer is not sufficient.
Say I deployed an contract A, then I deploy another contract B some time later. I want to make sure that a function
A.f1() in A can only be called from contract B. To do so, I implement a function
register(address trusted_contract) to register B to A, which basically stores B's address to an array in A.. Since I own A, I'm the only one who can call it to register an address.
Now if B calls
A.f1(), then within
f1(), I check if
msg.sender is in the array and decide if to serve the call.
Is this the right way to do it?
If it is, I still have a questions. What prevent another contract C to send a msg and claims that it is B? My understanding is that unlike an external account, a contract does not have a private key and thus can not sign a message. If so, how does receiver A verify the caller is contract B, not some bad actor C?