@etherisc/gif-next 0.0.2-71cf987-554 → 0.0.2-7202758-806

package/contracts/authorization/AccessAdmin.sol

@@ -8,11 +8,16 @@ import {ReentrancyGuardUpgradeable} from "@openzeppelin/contracts-upgradeable/ut
 import {AccessManagerCloneable} from "./AccessManagerCloneable.sol";
 import {ContractLib} from "../shared/ContractLib.sol";
 import {IAccessAdmin} from "./IAccessAdmin.sol";
+import {IRegistry} from "../registry/IRegistry.sol";
 import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
 import {Selector, SelectorLib, SelectorSetLib} from "../type/Selector.sol";
 import {Str, StrLib} from "../type/String.sol";
 import {TimestampLib} from "../type/Timestamp.sol";
+import {VersionPart} from "../type/Version.sol";
 
+interface IAccessManagedChecker {
+    function authority() external view returns (address);
+}
 
 /**
  * @dev A generic access amin contract that implements role based access control based on OpenZeppelin's AccessManager contract.
@@ -68,7 +73,7 @@ contract AccessAdmin is
 
     modifier onlyDeployer() {
         // special case for cloned AccessAdmin contracts
-        // IMPORTANT cloning and _initializeAuthority needs to be done in a single transaction
+        // IMPORTANT cloning and initialize authority needs to be done in a single transaction
         if (_deployer == address(0)) {
             _deployer = msg.sender;
         }
@@ -95,8 +100,15 @@ contract AccessAdmin is
         _;
     }
 
-    modifier onlyExistingRole(RoleId roleId, bool onlyActiveRole) {
-        _checkRoleExists(roleId, onlyActiveRole);
+    modifier onlyExistingRole(
+        RoleId roleId, 
+        bool onlyActiveRole,
+        bool allowLockedRoles
+    )
+    {
+        if (!allowLockedRoles) {
+            _checkRoleExists(roleId, onlyActiveRole);
+        }
         _;
     }
 
@@ -107,40 +119,52 @@ contract AccessAdmin is
 
     //-------------- initialization functions ------------------------------//
 
+    // event LogAccessAdminDebug(string message);
+
     /// @dev Initializes this admin with the provided accessManager (and authorization specification).
     /// Internally initializes access manager with this admin and creates basic role setup.
     function initialize(
         AccessManagerCloneable authority 
-        //,IAuthorization authorization
     )
         public
-        virtual
-        initializer
-        onlyDeployer() // initializes deployer if not initialized yet
+        initializer()
     {
-        // set and initialize access manager for this admin
-        // admin role is granted before it is created
-        _initializeAuthority(authority);
-
-        // create basic admin independent setup
-        _initializeAdminAndPublicRoles();
-
-        //_authorization = authorization;
+        __AccessAdmin_init(authority);
     }
 
-    function _initializeAuthority(
-        AccessManagerCloneable authority
+
+    function __AccessAdmin_init(
+        AccessManagerCloneable authority 
     )
         internal
-        virtual
         onlyInitializing()
+        onlyDeployer() // initializes deployer if not initialized yet
     {
+        authority.initialize(address(this));
+
+        // set and initialize this access manager contract as
+        // the admin (ADMIN_ROLE) of the provided authority
+        __AccessManaged_init(address(authority));
         _authority = authority;
-        _authority.initialize(address(this));
 
-        __AccessManaged_init(address(_authority));
+        // create admin and public roles
+        _initializeAdminAndPublicRoles();
+
+        // additional use case specific initialization
+        _initializeCustom();
+    }
+
+
+    function getRegistry() public view returns (IRegistry registry) {
+        return _authority.getRegistry();
     }
 
+
+    function getRelease() public view returns (VersionPart release) {
+        return _authority.getRelease();
+    }
+
+
     function _initializeAdminAndPublicRoles()
         internal
         virtual
@@ -170,6 +194,13 @@ contract AccessAdmin is
                 name: PUBLIC_ROLE_NAME}));
     }
 
+
+    function _initializeCustom()
+        internal
+        virtual
+        onlyInitializing()
+    { }
+
     //--- view functions for roles ------------------------------------------//
 
     function roles() external view returns (uint256 numberOfRoles) {
@@ -317,7 +348,11 @@ contract AccessAdmin is
         bytes4[] memory functionSelectors = _processFunctionSelectors(target, functions, addFunctions);
 
         // apply authz via access manager
-        _grantRoleAccessToFunctions(target, roleId, functionSelectors);
+        _grantRoleAccessToFunctions(
+            target, 
+            roleId, 
+            functionSelectors, 
+            false); // allowLockedRoles
     }
 
     function _unauthorizeTargetFunctions(
@@ -328,7 +363,12 @@ contract AccessAdmin is
     {
         bool addFunctions = false;
         bytes4[] memory functionSelectors = _processFunctionSelectors(target, functions, addFunctions);
-        _grantRoleAccessToFunctions(target, getAdminRole(), functionSelectors);
+
+        _grantRoleAccessToFunctions(
+            target, 
+            getAdminRole(), 
+            functionSelectors, 
+            true); // allowLockedRoles
     }
 
     function _processFunctionSelectors(
@@ -367,11 +407,12 @@ contract AccessAdmin is
     function _grantRoleAccessToFunctions(
         address target,
         RoleId roleId, 
-        bytes4[] memory functionSelectors
+        bytes4[] memory functionSelectors,
+        bool allowLockedRoles // admin and public roles are locked
     )
         internal
         onlyExistingTarget(target)
-        onlyExistingRole(roleId, true)
+        onlyExistingRole(roleId, true, allowLockedRoles)
     {
         _authority.setTargetFunctionRole(
             target,
@@ -385,7 +426,7 @@ contract AccessAdmin is
     /// @dev grant the specified role to the provided account
     function _grantRoleToAccount(RoleId roleId, address account)
         internal
-        onlyExistingRole(roleId, true)
+        onlyExistingRole(roleId, true, false)
     {
         // check max role members will not be exceeded
         if (_roleMembers[roleId].length() >= _roleInfo[roleId].maxMemberCount) {
@@ -413,7 +454,7 @@ contract AccessAdmin is
     /// @dev revoke the specified role from the provided account
     function _revokeRoleFromAccount(RoleId roleId, address account)
         internal
-        onlyExistingRole(roleId, false)
+        onlyExistingRole(roleId, false, false)
     {
 
         // check role removal is permitted
@@ -497,7 +538,6 @@ contract AccessAdmin is
         bool custom
     )
         internal
-        nonReentrant() // TODO no state changing calls in this function -> impossible to reenter
     {
         // check target does not yet exist
         if(targetExists(target)) {
@@ -521,7 +561,7 @@ contract AccessAdmin is
         }
 
         // check target is an access managed contract
-        if (!ContractLib.isAccessManaged(target)) {
+        if (!_isAccessManaged(target)) {
             revert ErrorTargetNotAccessManaged(target);
         }
 
@@ -550,6 +590,23 @@ contract AccessAdmin is
     }
 
 
+    function _isAccessManaged(address target)
+        internal
+        view
+        returns (bool)
+    {
+        if (!ContractLib.isContract(target)) {
+            return false;
+        }
+
+        (bool success, ) = target.staticcall(
+            abi.encodeWithSelector(
+                IAccessManagedChecker.authority.selector));
+
+        return success;
+    }
+
+
     function _setTargetClosed(address target, bool locked)
         internal
     {
@@ -577,6 +634,7 @@ contract AccessAdmin is
 
         uint64 roleIdInt = RoleId.unwrap(roleId);
         if (roleIdInt == _authority.ADMIN_ROLE())
+        // TODO cleanup
             //|| roleIdInt == _authority.PUBLIC_ROLE()) prevents granting of public role
         {
             revert ErrorRoleIsLocked(roleId);

package/contracts/authorization/AccessManagerCloneable.sol

@@ -1,24 +1,31 @@
 // SPDX-License-Identifier: UNLICENSED
 pragma solidity ^0.8.20;
 
-import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
 import {AccessManagerUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagerUpgradeable.sol";
+import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
+import {IAccessManager} from "@openzeppelin/contracts/access/manager/IAccessManager.sol";
 
-import {VersionPart} from "../type/Version.sol";
-
+import {InitializableERC165} from "../shared/InitializableERC165.sol";
 import {RegistryLinked} from "../shared/RegistryLinked.sol";
+import {VersionPart, VersionLib} from "../type/Version.sol";
 
-import {IRegistry} from "../registry/IRegistry.sol";
 
-// cloned by upon release preparation and instance cloning
+/// @dev An AccessManager based on OpenZeppelin that is cloneable and has a central lock property.
+/// The lock property allows to lock all services of a release in a central place.
+/// Cloned by upon release preparation and instance cloning.
 contract AccessManagerCloneable is
     AccessManagerUpgradeable,
+    InitializableERC165,
     RegistryLinked
 {
     error ErrorAccessManagerCallerNotAdmin(address caller);
     error ErrorAccessManagerRegistryAlreadySet(address registry);
+    error ErrorAccessManagerInvalidRelease(VersionPart release);
+
     error ErrorAccessManagerTargetAdminLocked(address target);
+    error ErrorAccessManagerCallerAdminLocked(address caller);
 
+    VersionPart private _release;
     bool private _isLocked;
 
     modifier onlyAdminRole() {
@@ -29,40 +36,70 @@ contract AccessManagerCloneable is
         _;
     }
 
-
     function initialize(address admin)
         external
         initializer()
     {
         __AccessManager_init(admin);
+        _initializeERC165();
+        _registerInterface(type(IAccessManager).interfaceId);
     }
 
-    function completeSetup(address registry, VersionPart version)
-        public
+
+    /// @dev Completes the setup of the access manager.
+    /// Links the access manager to the registry and sets the release version.
+    function completeSetup(
+        address registry, 
+        VersionPart release
+    )
+        external
         onlyAdminRole
-        reinitializer(uint64(version.toInt()))
+        reinitializer(uint64(release.toInt()))
     {
-        address setRegistry = address(getRegistry());
+        _completeSetup(registry, release, true);
+    }
 
-        if(setRegistry != address(0)) {
-            revert ErrorAccessManagerRegistryAlreadySet(setRegistry);
-        }
-        _initializeRegistryLinked(registry);
+    /// @dev Completes the setup of the access manager.
+    /// Links the access manager to the registry and sets the release version.
+    function completeSetup(
+        address registry, 
+        VersionPart release,
+        bool verifyRelease
+    )
+        public
+        onlyAdminRole
+        reinitializer(uint64(release.toInt()))
+    {
+        _completeSetup(registry, release, verifyRelease);
     }
 
+    /// @dev Returns true if the caller is authorized to call the target with the given selector and the manager lock is not set to locked.
+    /// Feturn values as in OpenZeppelin AccessManager.
+    /// For a locked manager the function reverts with ErrorAccessManagerTargetAdminLocked.
     function canCall(
         address caller,
         address target,
         bytes4 selector
-    ) public view virtual override returns (bool immediate, uint32 delay) 
+    )
+        public 
+        view 
+        virtual override 
+        returns (
+            bool immediate, 
+            uint32 delay
+        ) 
     {
         (immediate, delay) = super.canCall(caller, target, selector);
 
-        if(isLocked()) {
+        // locking of all contracts under control of this access manager
+        if (isLocked()) {
             revert ErrorAccessManagerTargetAdminLocked(target);
         }
     }
 
+
+    /// @dev Locks/unlocks all services of this access manager.
+    /// Only the corresponding access admin can lock/unlock the services.
     function setLocked(bool locked)
         external
         onlyAdminRole() 
@@ -70,6 +107,16 @@ contract AccessManagerCloneable is
         _isLocked = locked;
     }
 
+
+    /// @dev Returns the release version of this access manager.
+    /// For the registry admin release 3 is returned.
+    /// For the release admin and the instance admin the actual release version is returned.
+    function getRelease() external view returns (VersionPart release) {
+        return _release;
+    }
+
+
+    /// @dev Returns true iff all contracts of this access manager are locked.
     function isLocked()
         public
         view
@@ -77,4 +124,26 @@ contract AccessManagerCloneable is
     {
         return _isLocked;
     }
+
+
+    function _completeSetup(
+        address registry,
+        VersionPart release,
+        bool verifyRelease
+    )
+        internal
+    {
+        // checks
+        if(address(getRegistry()) != address(0)) {
+            revert ErrorAccessManagerRegistryAlreadySet(address(getRegistry()) );
+        }
+
+        if (verifyRelease && !release.isValidRelease()) {
+            revert ErrorAccessManagerInvalidRelease(release);
+        }
+
+        // effects
+        __RegistryLinked_init(registry);
+        _release = release;
+    }
 }

package/contracts/authorization/IAccessAdmin.sol

@@ -4,14 +4,16 @@ pragma solidity ^0.8.20;
 import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
 
 import {IAccess} from "./IAccess.sol";
+import {IRegistryLinked} from "../shared/IRegistryLinked.sol";
 import {RoleId} from "../type/RoleId.sol";
 import {Selector} from "../type/Selector.sol";
 import {Str} from "../type/String.sol";
-import {Timestamp} from "../type/Timestamp.sol";
+import {VersionPart} from "../type/Version.sol";
 
 interface IAccessAdmin is 
     IAccessManaged,
-    IAccess
+    IAccess,
+    IRegistryLinked
 {
 
     // roles
@@ -105,6 +107,8 @@ interface IAccessAdmin is
 
     //--- view functions ----------------------------------------------------//
 
+    function getRelease() external view returns (VersionPart release);
+
     function roles() external view returns (uint256 numberOfRoles);
     function getRoleId(uint256 idx) external view returns (RoleId roleId);
     function getAdminRole() external view returns (RoleId roleId);

package/contracts/distribution/BasicDistribution.sol

@@ -44,8 +44,8 @@ contract BasicDistribution is
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
         returns (DistributorType distributorType)
     {
         return _createDistributorType(
@@ -67,25 +67,25 @@ contract BasicDistribution is
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
         returns(NftId distributorNftId)
     {
         return _createDistributor(distributor, distributorType, data);
     }
 
-    function updateDistributorType(
+    function changeDistributorType(
         NftId distributorNftId,
         DistributorType distributorType,
         bytes memory data
     )
         external
         virtual
+        restricted()
         onlyOwner()
         onlyNftOfType(distributorNftId, DISTRIBUTOR())
-        restricted()
     {
-        _updateDistributorType(distributorNftId, distributorType, data);
+        _changeDistributorType(distributorNftId, distributorType, data);
     }
 
     /**
@@ -101,8 +101,8 @@ contract BasicDistribution is
     )
         external
         virtual
-        onlyDistributor()
         restricted()
+        onlyDistributor()
         returns (ReferralId referralId)
     {
         NftId distributorNftId = getDistributorNftId(msg.sender);

package/contracts/distribution/BasicDistributionAuthorization.sol

@@ -37,7 +37,7 @@ contract BasicDistributionAuthorization
           _authorize(functions, BasicDistribution.setFees.selector, "setFees");
           _authorize(functions, BasicDistribution.createDistributorType.selector, "createDistributorType");
           _authorize(functions, BasicDistribution.createDistributor.selector, "createDistributor");
-          _authorize(functions, BasicDistribution.updateDistributorType.selector, "updateDistributorType");
+          _authorize(functions, BasicDistribution.changeDistributorType.selector, "changeDistributorType");
           _authorize(functions, BasicDistribution.createReferral.selector, "createReferral");
           
           _authorize(functions, IInstanceLinkedComponent.withdrawFees.selector, "withdrawFees");

package/contracts/distribution/Distribution.sol

@@ -37,6 +37,32 @@ abstract contract Distribution is
     }
 
 
+    function processRenewal(
+        ReferralId referralId,
+        uint256 feeAmount
+    )
+        external
+        virtual
+        restricted()
+    {
+        // default is no action
+    }
+
+
+    /// @inheritdoc IDistributionComponent
+    function withdrawCommission(NftId distributorNftId, Amount amount) 
+        external 
+        virtual
+        restricted()
+        onlyDistributor()
+        onlyNftOfType(distributorNftId, DISTRIBUTOR())
+        onlyNftOwner(distributorNftId)
+        returns (Amount withdrawnAmount) 
+    {
+        return _withdrawCommission(distributorNftId, amount);
+    }
+
+
     function isDistributor(address candidate)
         public
         view
@@ -97,35 +123,12 @@ abstract contract Distribution is
     }
 
 
-    function processRenewal(
-        ReferralId referralId,
-        uint256 feeAmount
-    )
-        external
-        virtual
-        restricted()
-    {
-        // default is no action
-    }
-
     /// @dev Returns true iff the component needs to be called when selling/renewing policis
     function isVerifying() external pure returns (bool verifying) {
         return true;
     }
 
-    /// @inheritdoc IDistributionComponent
-    function withdrawCommission(NftId distributorNftId, Amount amount) 
-        external 
-        virtual
-        restricted()
-        onlyDistributor()
-        onlyNftOfType(distributorNftId, DISTRIBUTOR())
-        onlyNftOwner(distributorNftId)
-        returns (Amount withdrawnAmount) 
-    {
-        return _withdrawCommission(distributorNftId, amount);
-    }
-        
+
     function _initializeDistribution(
         address registry,
         NftId productNftId,
@@ -223,7 +226,7 @@ abstract contract Distribution is
     }
 
     /// @dev Uptates the distributor type for the specified distributor.
-    function _updateDistributorType(
+    function _changeDistributorType(
         NftId distributorNftId,
         DistributorType distributorType,
         bytes memory data
@@ -232,11 +235,10 @@ abstract contract Distribution is
         virtual
     {
         DistributionStorage storage $ = _getDistributionStorage();
-        // TODO re-enable once implemented
-        // $._distributionService.updateDistributorType(
-        //     distributorNftId,
-        //     distributorType,
-        //     data);
+        $._distributionService.changeDistributorType(
+            distributorNftId,
+            distributorType,
+            data);
     }
 
     /// @dev Create a new referral code for the provided distributor.