@cofhe/mock-contracts 0.7.1 → 1.0.0-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @cofhe/mock-contracts Changelog
 
+## 0.8.0
+
+### Minor Changes
+
+- 6f7a4c5: Resolve the Task Manager through the `CoFHEAddressBook` (`@fhenixprotocol/cofhe-contracts@1.0.0`). **Breaking:** `TASK_MANAGER_ADDRESS` is removed from `@cofhe/sdk`. Use `getTaskManagerAddress(publicClient)`, which reads `getTm(TASK_MANAGER_ID)` from the book at `COFHE_ADDRESS_BOOK_ADDRESS` (both exported) and caches the result per chain. If the chain has no book, or the id is unset, it throws `TASK_MANAGER_UNRESOLVED`. `verifyDecryptResult`, the ACL/ACP lookups and `useCofheEnabled` / `useCofheReadDecryptionResults` now resolve the Task Manager this way. `@cofhe/react` adds `useCofheTaskManagerAddress()`.
+
+  Mocks: a new `MockCoFHEAddressBook` is deployed at FHE.sol's `COFHE_ADDRESS_BOOK`, and `MockTaskManager` moves to `MOCKS_TASK_MANAGER_ADDRESS` (`0x…5000`) and is registered in the book. `MockACL` now stores its Task Manager (`setTaskManager` / `getTaskManagerAddress`) instead of reading a constant, so its `TASK_MANAGER_ADDRESS_()` getter is gone. All three plugins deploy and wire the book. Hardhat 2 exposes `hre.cofhe.mocks.getMockCoFHEAddressBook()`, Hardhat 3 exposes `conn.cofhe.mocks.MockCoFHEAddressBook`, and Foundry exposes `CofheTest.mockAddressBook`. Contracts must be built against `@fhenixprotocol/cofhe-contracts@1.0.0` or later (the hardhat plugin's peer range is now `>=1.0.0`). Each FHE op now makes one extra `getTm` call on the book, as it does on real networks, so expect slightly higher gas numbers.
+
+### Patch Changes
+
+- ccb7b68: Realistic gas reporting for mocks. Under Foundry, mock-only work is now excluded from gas metering by default (opt out with `mockTaskManager.setMockGasExcluded(false)`), so expect `forge snapshot` numbers to drop. Under Hardhat, mock transactions emit `MockGasConsumed` events (extra receipt logs), and the plugins add `getAdjustedGasUsed(receipt)` / `getAdjustedGasBreakdown(receipt)` plus an opt-in `cofhe.gasSummary` report.
+
 ## 0.7.1
 
 ### Patch Changes

package/README.md

@@ -10,6 +10,7 @@ A mock smart contract library for testing CoFHE (Confidential Computing Framewor
 ## Features
 
 - Mock implementations of core CoFHE contracts:
+  - MockCoFHEAddressBook (deployed at FHE.sol's `COFHE_ADDRESS_BOOK`, resolves the TaskManager)
   - MockTaskManager
   - MockThresholdNetwork
   - MockZkVerifier
@@ -137,6 +138,15 @@ When interacting with CoFHE this request is routed to the Threshold Network, whi
 
 When working with the mocks, the `cofheClient` instead queries the `MockThresholdNetwork` contract, which verifies the request `acp` and returns the decrypted result.
 
+### Gas
+
+Because the mocks replicate the off-chain FHE computation on-chain (plaintext math, mock storage writes, logging), transactions consume more gas than they would on a real CoFHE network. The mocks account for this in two ways:
+
+- **Foundry**: when gas exclusion is enabled (`setMockGasExcluded(true)` — the foundry plugin's `deployMocks()` does this automatically), the mock-only work runs between `pauseGasMetering` / `resumeGasMetering` cheatcodes, so forge's reported gas approximates real-network cost. Requires cheatcode access (`vm.allowCheatcodes(taskManagerAddress)`) and forge ≥ 1.0; without either, execution silently stays metered.
+- **Everywhere else** (Hardhat, anvil): `MockTaskManager` measures each block of mock-only work with `gasleft()` and emits a `MockGasConsumed(uint256)` event. Summing these events from a receipt and subtracting from `gasUsed` yields the adjusted cost — the hardhat plugins expose this as `getAdjustedGasUsed(receipt)` / `getAdjustedGasBreakdown(receipt)` and an opt-in `gasSummary` table.
+
+`eth_estimateGas` is never adjusted: the mock work really executes, so transactions still need the raw gas limit.
+
 ### Using Foundry
 
 Use [`@cofhe/foundry-plugin`](../foundry-plugin/README.md), which builds on these mocks. Inherit its

package/contracts/ACPShareRegistry.sol

@@ -1,8 +1,10 @@
 // SPDX-License-Identifier: MIT
-pragma solidity >=0.8.19 <0.9.0;
+pragma solidity >=0.8.25 <0.9.0;
 
-import { EnumerableSet } from '@openzeppelin/contracts/utils/structs/EnumerableSet.sol';
-import { ACP, IPermissionCustomIdValidator } from './Permissioned.sol';
+import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
+import {AccessControlUpgradeable} from "@openzeppelin/contracts-upgradeable/access/AccessControlUpgradeable.sol";
+import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
+import {ACP, IPermissionCustomIdValidator} from "./Permissioned.sol";
 
 /**
  * @notice On-chain hand-off for sharing ACPs — replaces the JSON copy-paste flow.
@@ -12,7 +14,15 @@ import { ACP, IPermissionCustomIdValidator } from './Permissioned.sol';
  * are indexed globally per recipient — a share is addressed to a person, and any
  * cofhesdk-enabled app may surface it.
  *
- * The registry stores the payload verbatim and stays deliberately dumb:
+ * Pointer-based: the full ACP and an optional metadata blob travel in the `Shared`
+ * event; storage keeps only the share header — the fields this contract checks
+ * (issuer, recipient, expiration, revoker) and the block of that event — plus the
+ * recipient's set of share ids. A reader takes the header from `sharesFor` / `getShare`
+ * and fetches the event with a `getLogs` over that one block, filtered by the
+ * share id topic. If that block holds several `Shared` events for the share id (it
+ * was removed and posted again within the block), the last one is the share.
+ *
+ * The registry stays deliberately dumb:
  *
  *  - The posted ACP carries `sealingKey = 0` and `recipientSignature = ""` — the
  *    recipient supplies both at import, exactly as in the off-chain flow.
@@ -20,126 +30,229 @@ import { ACP, IPermissionCustomIdValidator } from './Permissioned.sol';
  *    before the recipient signs, and the SDK validates everything at import. The
  *    trust the registry adds is `msg.sender == acp.issuer` — a share listed under
  *    a recipient was genuinely posted by its claimed issuer.
+ *  - The metadata is opaque bytes, never interpreted here (the SDK defines the
+ *    format: labels saying where each ctHash of a SNAPSHOT share came from). It is
+ *    written once, with the share, and cannot be replaced.
  *  - `isShareValid` is the verification hook for other contracts: share exists,
  *    is unexpired, and is not revoked (per the share's own revoker contract).
  *
- * Nothing stored here is sensitive: every field is part of the cleartext share
+ * Nothing posted here is sensitive: every field is part of the cleartext share
  * payload by design. Posting on-chain does make the issuer→recipient sharing
  * relationship public. (A future variant may accept an encrypted payload as a
  * parallel entry type; this registry's cleartext entries would be unaffected.)
- *
- * The production counterpart is upgradeable (OZ AccessControl for the upgrader
- * role) and deployed to a fixed address as core infrastructure.
  */
-contract ACPShareRegistry {
-  using EnumerableSet for EnumerableSet.Bytes32Set;
-
-  /// @notice recipient => ids of shares addressed to them
-  mapping(address => EnumerableSet.Bytes32Set) private _shareIdsFor;
-
-  /// @notice share id => stored payload
-  mapping(bytes32 => ACP) private _shares;
-
-  event Shared(address indexed recipient, address indexed issuer, bytes32 shareId);
-  event ShareRemoved(address indexed recipient, address indexed issuer, bytes32 shareId);
-
-  error NotIssuer();
-  error NotIssuerOrRecipient();
-  error RecipientMissing();
-  error SealingKeyMustBeEmpty();
-  error IssuerSignatureMissing();
-  error ShareExpired();
-  error AlreadyShared();
-  error UnknownShare();
-
-  /// @notice Post a sharing ACP for its recipient to pick up.
-  /// @dev The share id is the hash of the payload — reposting an identical share reverts.
-  function share(ACP calldata acp) external returns (bytes32 shareId) {
-    if (msg.sender != acp.issuer) revert NotIssuer();
-    if (acp.recipient == address(0)) revert RecipientMissing();
-    if (acp.sealingKey != bytes32(0)) revert SealingKeyMustBeEmpty();
-    if (acp.issuerSignature.length == 0) revert IssuerSignatureMissing();
-    if (acp.expiration < block.timestamp) revert ShareExpired();
-
-    shareId = keccak256(abi.encode(acp));
-    // the id commits to the recipient, so a duplicate can only be in this set
-    if (!_shareIdsFor[acp.recipient].add(shareId)) revert AlreadyShared();
-    _shares[shareId] = acp;
-
-    emit Shared(acp.recipient, acp.issuer, shareId);
-  }
-
-  /// @notice Remove a share. The issuer may retract it; the recipient may dismiss it
-  ///         (e.g. after importing, or to decline).
-  function removeShare(bytes32 shareId) external {
-    ACP storage acp = _shares[shareId];
-    if (acp.issuer == address(0)) revert UnknownShare();
-    if (msg.sender != acp.issuer && msg.sender != acp.recipient) revert NotIssuerOrRecipient();
-
-    address recipient = acp.recipient;
-    address issuer = acp.issuer;
-
-    // the id set and the payload map stay in sync — mirror share()'s add() handling
-    if (!_shareIdsFor[recipient].remove(shareId)) revert UnknownShare();
-    delete _shares[shareId];
-
-    emit ShareRemoved(recipient, issuer, shareId);
-  }
-
-  /// @notice All importable shares addressed to `recipient`: unexpired and not revoked.
-  ///         Dead entries stay in storage until removed but are filtered here.
-  function sharesFor(address recipient) external view returns (ACP[] memory acps) {
-    EnumerableSet.Bytes32Set storage ids = _shareIdsFor[recipient];
-    uint256 len = ids.length();
-    if (len == 0) return acps;
-
-    // single pass: allocate for the maximum, fill with valid shares only
-    acps = new ACP[](len);
-    uint256 live = 0;
-    for (uint256 i = 0; i < len; i++) {
-      ACP storage acp = _shares[ids.at(i)];
-      if (_isValid(acp)) {
-        acps[live] = acp;
-        live++;
-      }
+contract ACPShareRegistry is UUPSUpgradeable, AccessControlUpgradeable {
+    using EnumerableSet for EnumerableSet.Bytes32Set;
+
+    /// @notice Role allowed to upgrade the implementation.
+    bytes32 public constant UPGRADER_ROLE = keccak256("UPGRADER_ROLE");
+
+    /// @notice What storage keeps of a share: the fields `removeShare` and the validity
+    ///         check read, and where to find the rest.
+    /// @dev Packed into four slots; the two revoker slots stay zero for a share without
+    ///      a revoker.
+    struct ShareHeader {
+        address issuer;
+        uint64 expiration;
+        address recipient;
+        /// @dev Block of the `Shared` event that carries the full ACP and the metadata
+        ///      (the L2 block on Arbitrum). The last `Shared` event for the share id in that
+        ///      block, should it hold more than one.
+        uint64 blockNumber;
+        address revokerContract;
+        uint256 revokerData;
+    }
+
+    /// @custom:storage-location erc7201:cofhe.storage.ACPShareRegistry.v2
+    struct ACPShareRegistryStorage {
+        /// @dev recipient => ids of shares addressed to them
+        mapping(address => EnumerableSet.Bytes32Set) shareIdsFor;
+        /// @dev share id => stored header
+        mapping(bytes32 => ShareHeader) headers;
+    }
+
+    /// @dev keccak256(abi.encode(uint256(keccak256("cofhe.storage.ACPShareRegistry.v2")) - 1)) & ~bytes32(uint256(0xff))
+    bytes32 private constant ACP_SHARE_REGISTRY_SLOT =
+        keccak256(abi.encode(uint256(keccak256("cofhe.storage.ACPShareRegistry.v2")) - 1)) & ~bytes32(uint256(0xff));
+
+    /// @notice The first version's storage, which kept every share whole. Abandoned by the
+    ///         in-place upgrade: nothing reads it, and its shares are not carried over. Declared
+    ///         only so the namespace stays reserved (the OpenZeppelin layout check requires it).
+    /// @custom:storage-location erc7201:cofhe.storage.ACPShareRegistry
+    struct ACPShareRegistryStorageV1 {
+        /// @dev recipient => ids of shares addressed to them
+        mapping(address => EnumerableSet.Bytes32Set) shareIdsFor;
+        /// @dev share id => stored payload
+        mapping(bytes32 => ACP) shares;
+    }
+
+    /// @notice A share was posted. `acp` is the payload as posted; `metadata` is the opaque
+    ///         blob that came with it (empty when none). The share id is
+    ///         `keccak256(abi.encode(acp))`. A share removed and posted again in the same block
+    ///         emits this twice there with the same id; the later one (higher log index) is
+    ///         the share, and only its `metadata` can differ.
+    event Shared(address indexed recipient, address indexed issuer, bytes32 indexed shareId, ACP acp, bytes metadata);
+    event ShareRemoved(address indexed recipient, address indexed issuer, bytes32 indexed shareId);
+
+    error NotIssuer();
+    error NotIssuerOrRecipient();
+    error RecipientMissing();
+    error SealingKeyMustBeEmpty();
+    error IssuerSignatureMissing();
+    error ShareExpired();
+    error AlreadyShared();
+    error UnknownShare();
+
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
     }
 
-    // truncate the memory array's length to the live count (shrink-only)
-    if (live < len) {
-      assembly {
-        mstore(acps, live)
-      }
+    /**
+     * @notice              Initializes the contract.
+     * @param initialAdmin  Receives DEFAULT_ADMIN_ROLE and UPGRADER_ROLE.
+     */
+    function initialize(address initialAdmin) public initializer {
+        __AccessControl_init();
+        _grantRole(DEFAULT_ADMIN_ROLE, initialAdmin);
+        _grantRole(UPGRADER_ROLE, initialAdmin);
     }
-  }
-
-  /// @notice A single share by id (zeroed struct if unknown/removed).
-  function getShare(bytes32 shareId) external view returns (ACP memory) {
-    return _shares[shareId];
-  }
-
-  /// @notice Verification hook for contracts: the share exists, was posted by its
-  ///         claimed issuer (guaranteed at posting), is unexpired, and is not
-  ///         revoked per its own revoker contract.
-  function isShareValid(bytes32 shareId) external view returns (bool) {
-    if (_shares[shareId].issuer == address(0)) return false;
-    return _isValid(_shares[shareId]);
-  }
-
-  /// @dev Unexpired and not revoked. The revoker call mirrors `withPermission`'s
-  ///      revocation clause; a reverting revoker fails closed (share invalid).
-  function _isValid(ACP storage acp) private view returns (bool) {
-    if (acp.expiration < block.timestamp) return false;
-
-    if (acp.revokerData != 0 && acp.revokerContract != address(0)) {
-      try IPermissionCustomIdValidator(acp.revokerContract).disabled(acp.issuer, acp.revokerData) returns (
-        bool disabled
-      ) {
-        if (disabled) return false;
-      } catch {
-        return false;
-      }
+
+    /// @notice Post a sharing ACP for its recipient to pick up, with an optional metadata
+    ///         blob (`""` for none).
+    /// @dev The share id is the hash of the payload — reposting an identical share reverts,
+    ///      whatever its metadata.
+    function share(ACP calldata acp, bytes calldata metadata) external returns (bytes32 shareId) {
+        if (msg.sender != acp.issuer) revert NotIssuer();
+        if (acp.recipient == address(0)) revert RecipientMissing();
+        if (acp.sealingKey != bytes32(0)) revert SealingKeyMustBeEmpty();
+        if (acp.issuerSignature.length == 0) revert IssuerSignatureMissing();
+        if (acp.expiration < block.timestamp) revert ShareExpired();
+
+        ACPShareRegistryStorage storage $ = _getStorage();
+
+        shareId = keccak256(abi.encode(acp));
+        // the id commits to the recipient, so a duplicate can only be in this set
+        if (!$.shareIdsFor[acp.recipient].add(shareId)) revert AlreadyShared();
+        $.headers[shareId] = ShareHeader({
+            issuer: acp.issuer,
+            expiration: acp.expiration,
+            recipient: acp.recipient,
+            blockNumber: uint64(_blockNumber()),
+            revokerContract: acp.revokerContract,
+            revokerData: acp.revokerData
+        });
+
+        emit Shared(acp.recipient, acp.issuer, shareId, acp, metadata);
     }
 
-    return true;
-  }
+    /// @notice Remove a share. The issuer may retract it; the recipient may dismiss it
+    ///         (e.g. after importing, or to decline). The `Shared` event stays in its block;
+    ///         readers go by the header, which is gone.
+    function removeShare(bytes32 shareId) external {
+        ACPShareRegistryStorage storage $ = _getStorage();
+
+        ShareHeader storage header = $.headers[shareId];
+        if (header.issuer == address(0)) revert UnknownShare();
+        if (msg.sender != header.issuer && msg.sender != header.recipient) revert NotIssuerOrRecipient();
+
+        address recipient = header.recipient;
+        address issuer = header.issuer;
+
+        // the id set and the header map stay in sync — mirror share()'s add() handling
+        if (!$.shareIdsFor[recipient].remove(shareId)) revert UnknownShare();
+        delete $.headers[shareId];
+
+        emit ShareRemoved(recipient, issuer, shareId);
+    }
+
+    /// @notice The importable shares addressed to `recipient` — unexpired and not revoked —
+    ///         as their ids and headers, index for index. Dead entries stay in storage until
+    ///         removed but are filtered here.
+    function sharesFor(
+        address recipient
+    ) external view returns (bytes32[] memory shareIds, ShareHeader[] memory headers) {
+        ACPShareRegistryStorage storage $ = _getStorage();
+        EnumerableSet.Bytes32Set storage ids = $.shareIdsFor[recipient];
+        uint256 len = ids.length();
+
+        // single pass: allocate for the maximum, fill with valid shares only
+        shareIds = new bytes32[](len);
+        headers = new ShareHeader[](len);
+        uint256 live = 0;
+        for (uint256 i = 0; i < len; i++) {
+            bytes32 shareId = ids.at(i);
+            ShareHeader storage header = $.headers[shareId];
+            if (_isValid(header)) {
+                shareIds[live] = shareId;
+                headers[live] = header;
+                live++;
+            }
+        }
+
+        // truncate the memory arrays' length to the live count (shrink-only)
+        if (live < len) {
+            assembly {
+                mstore(shareIds, live)
+                mstore(headers, live)
+            }
+        }
+    }
+
+    /// @notice The header of a single share (zeroed struct if unknown/removed).
+    function getShare(bytes32 shareId) external view returns (ShareHeader memory) {
+        return _getStorage().headers[shareId];
+    }
+
+    /// @notice Verification hook for contracts: the share exists, was posted by its
+    ///         claimed issuer (guaranteed at posting), is unexpired, and is not
+    ///         revoked per its own revoker contract.
+    function isShareValid(bytes32 shareId) external view returns (bool) {
+        ShareHeader storage header = _getStorage().headers[shareId];
+        if (header.issuer == address(0)) return false;
+        return _isValid(header);
+    }
+
+    /// @dev Unexpired and not revoked. The revoker call mirrors `withPermission`'s
+    ///      revocation clause; a reverting revoker fails closed (share invalid).
+    function _isValid(ShareHeader storage header) private view returns (bool) {
+        if (header.expiration < block.timestamp) return false;
+
+        if (header.revokerData != 0 && header.revokerContract != address(0)) {
+            try IPermissionCustomIdValidator(header.revokerContract).disabled(header.issuer, header.revokerData) returns (
+                bool disabled
+            ) {
+                if (disabled) return false;
+            } catch {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// @dev The number a `getLogs` query takes for the current block. On Arbitrum `block.number`
+    ///      is an L1 block estimate and the L2 block comes from the ArbSys precompile; elsewhere
+    ///      nothing answers at that address and `block.number` is the block.
+    function _blockNumber() private view returns (uint256) {
+        (bool ok, bytes memory result) = address(100).staticcall(abi.encodeWithSignature("arbBlockNumber()"));
+        return ok && result.length == 32 ? abi.decode(result, (uint256)) : block.number;
+    }
+
+    /**
+     * @dev Should revert when `msg.sender` is not authorized to upgrade the contract.
+     *      Empty implementation since authorization is handled by the role check.
+     */
+    /* solhint-disable-next-line no-empty-blocks */
+    function _authorizeUpgrade(address _newImplementation) internal virtual override onlyRole(UPGRADER_ROLE) {}
+
+    /**
+     * @dev Returns the registry storage location.
+     */
+    function _getStorage() internal pure returns (ACPShareRegistryStorage storage $) {
+        bytes32 slot = ACP_SHARE_REGISTRY_SLOT;
+        assembly {
+            $.slot := slot
+        }
+    }
 }

package/contracts/ACPTimestampRevoker.sol

@@ -1,62 +1,64 @@
 // SPDX-License-Identifier: MIT
 pragma solidity >=0.8.19 <0.9.0;
 
-import { IPermissionCustomIdValidator } from './Permissioned.sol';
+import {IPermissionCustomIdValidator} from "./Permissioned.sol";
 
 /**
  * @notice Default ACP revoker — timestamp-based revocation.
  *
  * Implements the unchanged revoker interface. Interprets a permission's
- * `revokerData` as its creation timestamp (populated by the SDK at acp
- * creation). Every SDK-created acp points here by default: no upfront
- * contract call is needed — an ACP is revocable from birth.
+ * `revokerData` as its creation timestamp (populated by the SDK at permission
+ * creation, backdated 60s for clock skew). Every SDK-created permission points
+ * here by default: no upfront contract call is needed — a permission is
+ * revocable from birth.
  *
  * `disabled(issuer, id)` truth table:
  *
  *   | condition                   | result | meaning                          |
  *   |-----------------------------|--------|----------------------------------|
- *   | id > block.timestamp        | true   | future-dated acps never       |
+ *   | id > block.timestamp        | true   | future-dated permissions never   |
  *   |                             |        | validate (closes the revoke-all  |
- *   |                             |        | dodge: an ACP dated ahead of a|
- *   |                             |        | mass revocation would survive it)|
+ *   |                             |        | dodge: a permission dated ahead  |
+ *   |                             |        | of a mass revocation would       |
+ *   |                             |        | otherwise survive it)            |
  *   | id <= revokeAllAt[issuer]   | true   | mass revocation (inclusive)      |
  *   | revokedSingle[issuer][id]   | true   | targeted revocation              |
- *   | otherwise                   | false  | acp valid                     |
+ *   | otherwise                   | false  | permission valid                 |
  *
- * Accepted trade-offs (by design, see ACPV3 spec discussion):
- *  - Two acps minted by the same issuer in the same second share an id;
+ * Accepted trade-offs (by design, see ACP spec discussion):
+ *  - Two permissions minted by the same issuer in the same second share an id;
  *    revoking one revokes both. Over-revocation is the fail-safe direction.
  *  - Revocation is permanent — there is no un-revoke.
  *
- * The production counterpart is upgradeable (OZ AccessControl for the
- * upgrader role) and deployed to a fixed address as core infrastructure.
+ * @dev TODO(review): production wants this upgradeable (OZ AccessControl for the
+ *      upgrader role) and deployed to a fixed address as core infrastructure.
  */
 contract ACPTimestampRevoker is IPermissionCustomIdValidator {
-  /// @notice issuer => threshold; acps with id (creation ts) at or before this are revoked
-  mapping(address => uint256) public revokeAllAt;
+    /// @notice issuer => threshold; permissions with id (creation ts) at or before this are revoked
+    mapping(address => uint256) public revokeAllAt;
 
-  /// @notice issuer => id => revoked
-  mapping(address => mapping(uint256 => bool)) public revokedSingle;
+    /// @notice issuer => id => revoked
+    mapping(address => mapping(uint256 => bool)) public revokedSingle;
 
-  event RevokedSingle(address indexed issuer, uint256 indexed id);
-  event RevokedAll(address indexed issuer, uint256 at);
+    event RevokedSingle(address indexed issuer, uint256 indexed id);
+    event RevokedAll(address indexed issuer, uint256 at);
 
-  /// @notice Revoke a single acp by its id (creation timestamp).
-  ///         Only affects acps issued by the caller.
-  function revokeSingle(uint256 id) external {
-    revokedSingle[msg.sender][id] = true;
-    emit RevokedSingle(msg.sender, id);
-  }
+    /// @notice Revoke a single permission by its id (creation timestamp).
+    ///         Only affects permissions issued by the caller.
+    function revokeSingle(uint256 id) external {
+        revokedSingle[msg.sender][id] = true;
+        emit RevokedSingle(msg.sender, id);
+    }
 
-  /// @notice Revoke every acp the caller created up to now.
-  ///         O(1): a single threshold write, regardless of acp count.
-  function revokeAllExisting() external {
-    revokeAllAt[msg.sender] = block.timestamp;
-    emit RevokedAll(msg.sender, block.timestamp);
-  }
+    /// @notice Revoke every permission the caller created up to now.
+    ///         O(1): a single threshold write, regardless of permission count.
+    function revokeAllExisting() external {
+        revokeAllAt[msg.sender] = block.timestamp;
+        emit RevokedAll(msg.sender, block.timestamp);
+    }
 
-  /// @dev Called by the ACL during permission validation.
-  function disabled(address issuer, uint256 id) external view returns (bool) {
-    return id > block.timestamp || id <= revokeAllAt[issuer] || revokedSingle[issuer][id];
-  }
+    /// @dev Called by the ACL during permission validation.
+    function disabled(address issuer, uint256 id) external view returns (bool) {
+        return id > block.timestamp || id <= revokeAllAt[issuer] || revokedSingle[issuer][id];
+    }
 }