@etherisc/gif-next 0.0.2-7177fd8-761 → 0.0.2-71cf987-554

package/artifacts/contracts/upgradeability/UpgradableProxyWithAdmin.sol/UpgradableProxyWithAdmin.dbg.json

@@ -1,4 +1,4 @@
 {
   "_format": "hh-sol-dbg-1",
-  "buildInfo": "../../../build-info/9c2669b12fdb0fa7300d0a999ee0787c.json"
+  "buildInfo": "../../../build-info/7eac206222af6ba67328c22737fbf3c0.json"
 }

package/artifacts/contracts/upgradeability/Versionable.sol/Versionable.dbg.json

@@ -1,4 +1,4 @@
 {
   "_format": "hh-sol-dbg-1",
-  "buildInfo": "../../../build-info/9c2669b12fdb0fa7300d0a999ee0787c.json"
+  "buildInfo": "../../../build-info/7eac206222af6ba67328c22737fbf3c0.json"
 }

package/contracts/authorization/AccessAdmin.sol

@@ -6,11 +6,12 @@ import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet
 import {ReentrancyGuardUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/ReentrancyGuardUpgradeable.sol";
 
 import {AccessManagerCloneable} from "./AccessManagerCloneable.sol";
+import {ContractLib} from "../shared/ContractLib.sol";
 import {IAccessAdmin} from "./IAccessAdmin.sol";
 import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
 import {Selector, SelectorLib, SelectorSetLib} from "../type/Selector.sol";
 import {Str, StrLib} from "../type/String.sol";
-import {Timestamp, TimestampLib} from "../type/Timestamp.sol";
+import {TimestampLib} from "../type/Timestamp.sol";
 
 
 /**
@@ -79,9 +80,7 @@ contract AccessAdmin is
     }
 
     modifier onlyRoleAdmin(RoleId roleId) {
-        if (!roleExists(roleId)) {
-            revert ErrorRoleUnknown(roleId);
-        }
+        _checkRoleExists(roleId, false);
 
         if (!hasAdminRole(msg.sender, roleId)) {
             revert ErrorNotAdminOfRole(_roleInfo[roleId].adminRoleId);
@@ -96,8 +95,8 @@ contract AccessAdmin is
         _;
     }
 
-    modifier onlyExistingRole(RoleId roleId) {
-        _checkRoleId(roleId);
+    modifier onlyExistingRole(RoleId roleId, bool onlyActiveRole) {
+        _checkRoleExists(roleId, onlyActiveRole);
         _;
     }
 
@@ -106,14 +105,69 @@ contract AccessAdmin is
         _;
     }
 
-    constructor() {
-        _deployer = msg.sender;
-        _authority = new AccessManagerCloneable();
+    //-------------- initialization functions ------------------------------//
+
+    /// @dev Initializes this admin with the provided accessManager (and authorization specification).
+    /// Internally initializes access manager with this admin and creates basic role setup.
+    function initialize(
+        AccessManagerCloneable authority 
+        //,IAuthorization authorization
+    )
+        public
+        virtual
+        initializer
+        onlyDeployer() // initializes deployer if not initialized yet
+    {
+        // set and initialize access manager for this admin
+        // admin role is granted before it is created
+        _initializeAuthority(authority);
+
+        // create basic admin independent setup
+        _initializeAdminAndPublicRoles();
+
+        //_authorization = authorization;
+    }
+
+    function _initializeAuthority(
+        AccessManagerCloneable authority
+    )
+        internal
+        virtual
+        onlyInitializing()
+    {
+        _authority = authority;
         _authority.initialize(address(this));
 
-        _setAuthority(address(_authority)); // set authority for oz access managed
-        _createAdminAndPublicRoles();
-        _disableInitializers();
+        __AccessManaged_init(address(_authority));
+    }
+
+    function _initializeAdminAndPublicRoles()
+        internal
+        virtual
+        onlyInitializing()
+    {
+        RoleId adminRoleId = RoleIdLib.toRoleId(_authority.ADMIN_ROLE());
+
+        // setup admin role
+        _createRoleUnchecked(
+            ADMIN_ROLE(),
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: 1,
+                name: ADMIN_ROLE_NAME}));
+
+        // add this contract as admin role member
+        _roleMembers[adminRoleId].add(address(this));
+
+        // setup public role
+        _createRoleUnchecked(
+            PUBLIC_ROLE(),
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Gif,
+                maxMemberCount: type(uint32).max,
+                name: PUBLIC_ROLE_NAME}));
     }
 
     //--- view functions for roles ------------------------------------------//
@@ -154,6 +208,7 @@ contract AccessAdmin is
         return _roleMembers[roleId].at(idx);
     }
 
+    // TODO false because not role member or because role not exists?
     function hasRole(address account, RoleId roleId) public view returns (bool) {
         (bool isMember, ) = _authority.hasRole(
             RoleId.unwrap(roleId), 
@@ -219,18 +274,6 @@ contract AccessAdmin is
                 selector.toBytes4()));
     }
 
-    function isAccessManaged(address target) public view returns (bool) {
-        if (!_isContract(target)) {
-            return false;
-        }
-
-        (bool success, ) = target.staticcall(
-            abi.encodeWithSelector(
-                AccessManagedUpgradeable.authority.selector));
-
-        return success;
-    }
-
     function canCall(address caller, address target, Selector selector) external virtual view returns (bool can) {
         (can, ) = _authority.canCall(caller, target, selector.toBytes4());
     }
@@ -241,7 +284,8 @@ contract AccessAdmin is
             adminRoleId: adminRoleId,
             roleType: roleType,
             maxMemberCount: maxMemberCount,
-            createdAt: TimestampLib.blockTimestamp()
+            createdAt: TimestampLib.blockTimestamp(),
+            pausedAt: TimestampLib.max()
         });
     }
 
@@ -293,6 +337,7 @@ contract AccessAdmin is
         bool addFunctions
     )
         internal
+        onlyExistingTarget(target)
         returns (
             bytes4[] memory functionSelectors
         )
@@ -318,70 +363,6 @@ contract AccessAdmin is
         }
     }
 
-    function _initializeAuthority(
-        address authorityAddress
-    )
-        internal
-        virtual
-        onlyInitializing()
-        onlyDeployer()
-    {
-        if (authority() != address(0)) {
-            revert ErrorAuthorityAlreadySet();
-        }
-
-        _authority = AccessManagerCloneable(authorityAddress);
-        __AccessManaged_init(address(_authority));
-    }
-
-
-    function _initializeAdminAndPublicRoles()
-        internal
-        virtual
-        onlyInitializing()
-    {
-        _createAdminAndPublicRoles();
-    }
-
-
-    /// @dev internal setup function that can be used in both constructor and initializer.
-    function _createAdminAndPublicRoles()
-        internal
-    {
-        RoleId adminRoleId = RoleIdLib.toRoleId(_authority.ADMIN_ROLE());
-        FunctionInfo[] memory functions;
-
-        // setup admin role
-        _createRoleUnchecked(
-            ADMIN_ROLE(),
-            toRole({
-                adminRoleId: ADMIN_ROLE(),
-                roleType: RoleType.Contract,
-                maxMemberCount: 1,
-                name: ADMIN_ROLE_NAME}));
-
-        // add this contract as admin role member
-        _roleMembers[adminRoleId].add(address(this));
-
-        // setup public role
-        _createRoleUnchecked(
-            PUBLIC_ROLE(),
-            toRole({
-                adminRoleId: ADMIN_ROLE(),
-                roleType: RoleType.Gif,
-                maxMemberCount: type(uint32).max,
-                name: PUBLIC_ROLE_NAME}));
-    }
-
-    /// @dev check if target exists and reverts if it doesn't
-    function _checkTarget(address target)
-        internal
-    {
-        if (_targetInfo[target].createdAt.eqz()) {
-            revert ErrorTargetUnknown(target);
-        }
-    }
-
     /// @dev grant the specified role access to all functions in the provided selector list
     function _grantRoleAccessToFunctions(
         address target,
@@ -389,6 +370,8 @@ contract AccessAdmin is
         bytes4[] memory functionSelectors
     )
         internal
+        onlyExistingTarget(target)
+        onlyExistingRole(roleId, true)
     {
         _authority.setTargetFunctionRole(
             target,
@@ -398,22 +381,26 @@ contract AccessAdmin is
         // implizit logging: rely on OpenZeppelin log TargetFunctionRoleUpdated
     }
 
+
     /// @dev grant the specified role to the provided account
     function _grantRoleToAccount(RoleId roleId, address account)
         internal
+        onlyExistingRole(roleId, true)
     {
-        _checkRoleId(roleId);
-
         // check max role members will not be exceeded
         if (_roleMembers[roleId].length() >= _roleInfo[roleId].maxMemberCount) {
             revert ErrorRoleMembersLimitReached(roleId, _roleInfo[roleId].maxMemberCount);
         }
 
         // check account is contract for contract role
-        // TODO implement
-        if (_roleInfo[roleId].roleType == RoleType.Contract) {
+        if (
+            _roleInfo[roleId].roleType == RoleType.Contract &&
+            !ContractLib.isContract(account) // will fail in account's constructor
+        ) {
+            revert ErrorRoleMemberNotContract(roleId, account);
         }
 
+        // TODO check account already have roleId
         _roleMembers[roleId].add(account);
         _authority.grantRole(
             RoleId.unwrap(roleId), 
@@ -426,14 +413,15 @@ contract AccessAdmin is
     /// @dev revoke the specified role from the provided account
     function _revokeRoleFromAccount(RoleId roleId, address account)
         internal
+        onlyExistingRole(roleId, false)
     {
-        _checkRoleId(roleId);
 
         // check role removal is permitted
         if (_roleInfo[roleId].roleType == RoleType.Contract) {
-            revert ErrorRoleRemovalDisabled(roleId);
+            revert ErrorRoleMemberRemovalDisabled(roleId, account);
         }
 
+        // TODO check account have roleId?
         _roleMembers[roleId].remove(account);
         _authority.revokeRole(
             RoleId.unwrap(roleId), 
@@ -443,21 +431,6 @@ contract AccessAdmin is
     }
 
 
-    function _checkRoleId(RoleId roleId)
-        internal
-    {
-        if (_roleInfo[roleId].createdAt.eqz()) {
-            revert ErrorRoleUnknown(roleId);
-        }
-
-        uint64 roleIdInt = RoleId.unwrap(roleId);
-        if (roleIdInt == _authority.ADMIN_ROLE()
-            || roleIdInt == _authority.PUBLIC_ROLE())
-        {
-            revert ErrorRoleIsLocked(roleId);
-        }
-    }
-
     /// @dev Creates a role based on the provided parameters.
     /// Checks that the provided role and role id and role name not already used.
     function _createRole(
@@ -524,7 +497,7 @@ contract AccessAdmin is
         bool custom
     )
         internal
-        nonReentrant()
+        nonReentrant() // TODO no state changing calls in this function -> impossible to reenter
     {
         // check target does not yet exist
         if(targetExists(target)) {
@@ -548,7 +521,7 @@ contract AccessAdmin is
         }
 
         // check target is an access managed contract
-        if (!isAccessManaged(target)) {
+        if (!ContractLib.isAccessManaged(target)) {
             revert ErrorTargetNotAccessManaged(target);
         }
 
@@ -576,16 +549,53 @@ contract AccessAdmin is
         emit LogTargetCreated(target, targetName);
     }
 
-    function _isContract(address target)
+
+    function _setTargetClosed(address target, bool locked)
         internal
-        view 
-        returns (bool)
     {
-        uint256 size;
-        assembly {
-            size := extcodesize(target)
+        _checkTarget(target);
+
+        // target locked/unlocked already
+        if(_authority.isTargetClosed(target) == locked) {
+            revert ErrorTargetAlreadyLocked(target, locked);
+        }
+
+        _authority.setTargetClosed(target, locked);
+    }
+
+
+    function _checkRoleExists(
+        RoleId roleId, 
+        bool onlyActiveRole
+    )
+        internal
+        view
+    {
+        if (!roleExists(roleId)) {
+            revert ErrorRoleUnknown(roleId);
+        }
+
+        uint64 roleIdInt = RoleId.unwrap(roleId);
+        if (roleIdInt == _authority.ADMIN_ROLE())
+            //|| roleIdInt == _authority.PUBLIC_ROLE()) prevents granting of public role
+        {
+            revert ErrorRoleIsLocked(roleId);
+        }
+
+        // check if role is disabled
+        if (onlyActiveRole && _roleInfo[roleId].pausedAt <= TimestampLib.blockTimestamp()) {
+            revert ErrorRoleIsPaused(roleId);
+        }
+    }
+
+
+    /// @dev check if target exists and reverts if it doesn't
+    function _checkTarget(address target)
+        internal
+        view
+    {
+        if (!targetExists(target)) {
+            revert ErrorTargetUnknown(target);
         }
-        return size > 0;
     }
-    
 }

package/contracts/authorization/AccessManagerCloneable.sol

@@ -1,16 +1,80 @@
 // SPDX-License-Identifier: UNLICENSED
 pragma solidity ^0.8.20;
 
+import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
 import {AccessManagerUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagerUpgradeable.sol";
 
+import {VersionPart} from "../type/Version.sol";
+
+import {RegistryLinked} from "../shared/RegistryLinked.sol";
+
+import {IRegistry} from "../registry/IRegistry.sol";
+
+// cloned by upon release preparation and instance cloning
 contract AccessManagerCloneable is
-    AccessManagerUpgradeable
+    AccessManagerUpgradeable,
+    RegistryLinked
 {
+    error ErrorAccessManagerCallerNotAdmin(address caller);
+    error ErrorAccessManagerRegistryAlreadySet(address registry);
+    error ErrorAccessManagerTargetAdminLocked(address target);
+
+    bool private _isLocked;
+
+    modifier onlyAdminRole() {
+        (bool isMember, ) = hasRole(ADMIN_ROLE, msg.sender);
+        if(!isMember) {
+            revert ErrorAccessManagerCallerNotAdmin(msg.sender);
+        }
+        _;
+    }
 
-    function initialize(address initialAdmin)
+
+    function initialize(address admin)
         external
         initializer()
     {
-        __AccessManager_init(initialAdmin);
+        __AccessManager_init(admin);
+    }
+
+    function completeSetup(address registry, VersionPart version)
+        public
+        onlyAdminRole
+        reinitializer(uint64(version.toInt()))
+    {
+        address setRegistry = address(getRegistry());
+
+        if(setRegistry != address(0)) {
+            revert ErrorAccessManagerRegistryAlreadySet(setRegistry);
+        }
+        _initializeRegistryLinked(registry);
+    }
+
+    function canCall(
+        address caller,
+        address target,
+        bytes4 selector
+    ) public view virtual override returns (bool immediate, uint32 delay) 
+    {
+        (immediate, delay) = super.canCall(caller, target, selector);
+
+        if(isLocked()) {
+            revert ErrorAccessManagerTargetAdminLocked(target);
+        }
+    }
+
+    function setLocked(bool locked)
+        external
+        onlyAdminRole() 
+    {
+        _isLocked = locked;
+    }
+
+    function isLocked()
+        public
+        view
+        returns (bool)
+    {
+        return _isLocked;
     }
 }