@etherisc/gif-next 0.0.2-7d65090-351 → 0.0.2-7dc3cd3-858

package/contracts/registry/RegistryAdmin.sol

@@ -1,11 +1,11 @@
 // SPDX-License-Identifier: UNLICENSED
 pragma solidity ^0.8.20;
 
-import {AccessAdmin} from "../shared/AccessAdmin.sol";
-import {IAccessAdmin} from "../shared/IAccessAdmin.sol";
+import {AccessAdmin} from "../authorization/AccessAdmin.sol";
+import {IAccess} from "../authorization/IAccess.sol";
 import {IRegistry} from "./IRegistry.sol";
 import {IService} from "../shared/IService.sol";
-import {IServiceAuthorization} from "./IServiceAuthorization.sol";
+import {IServiceAuthorization} from "../authorization/IServiceAuthorization.sol";
 import {IStaking} from "../staking/IStaking.sol";
 import {ObjectType, ObjectTypeLib, ALL, POOL, RELEASE} from "../type/ObjectType.sol";
 import {ReleaseManager} from "./ReleaseManager.sol";
@@ -38,13 +38,17 @@ contract RegistryAdmin is
 
     string public constant GIF_ADMIN_ROLE_NAME = "GifAdminRole";
     string public constant GIF_MANAGER_ROLE_NAME = "GifManagerRole";
-    string public constant STAKING_SERVICE_ROLE_NAME = "StakingServiceRole";
     string public constant POOL_SERVICE_ROLE_NAME = "PoolServiceRole";
+    string public constant RELEASE_MANAGER_ROLE_NAME = "ReleaseManagerRole";
+    string public constant STAKING_SERVICE_ROLE_NAME = "StakingServiceRole";
+    string public constant STAKING_ROLE_NAME = "StakingRole";
 
-    string public constant RELEASE_MANAGER_TARGET_NAME = "ReleaseManagerTarget";
-    string public constant TOKEN_REGISTRY_TARGET_NAME = "TokenRegistryTarget";
-    string public constant STAKING_TARGET_NAME = "StakingTarget";
-    string public constant STAKING_STORE_TARGET_NAME = "StakingStoreTarget";
+    string public constant RELEASE_MANAGER_TARGET_NAME = "ReleaseManager";
+    string public constant TOKEN_REGISTRY_TARGET_NAME = "TokenRegistry";
+    string public constant STAKING_TARGET_NAME = "Staking";
+    string public constant STAKING_STORE_TARGET_NAME = "StakingStore";
+
+    uint8 public constant MAX_NUM_RELEASES = 99;
 
     mapping(address service => VersionPart majorVersion) private _ServiceRelease;
 
@@ -74,7 +78,7 @@ contract RegistryAdmin is
             IStaking(_staking).getStakingStore());
 
         // at this moment all registry contracts are deployed and fully intialized
-        _createTarget(_tokenRegistry, TOKEN_REGISTRY_TARGET_NAME);
+        _createTarget(_tokenRegistry, TOKEN_REGISTRY_TARGET_NAME, true, false);
 
         _setupGifAdminRole(gifAdmin);
         _setupGifManagerRole(gifManager);
@@ -112,50 +116,39 @@ contract RegistryAdmin is
     function _createServiceTargetAndRole(IService service)
         private
     {
-        ObjectType domain = service.getDomain();
-        string memory baseName = ObjectTypeLib.toName(domain);
+        ObjectType serviceDomain = service.getDomain();
+        string memory baseName = ObjectTypeLib.toName(serviceDomain);
         VersionPart version = service.getVersion().toMajorPart();
         uint256 versionInt = version.toInt();
-        string memory versionName = "_v0";
-        string memory versionNumber = ObjectTypeLib.toString(versionInt);
-
-        if (versionInt >= 10) {
-            versionName = "_v";
-        }
 
         // create service target
-        string memory serviceTargetName = string(
-            abi.encodePacked(
-                baseName,
-                "Service",
-                versionName,
-                versionNumber));
+        string memory serviceTargetName = ObjectTypeLib.toVersionedName(
+            baseName, "Service", versionInt);
 
         _createTarget(
             address(service), 
-            serviceTargetName);
+            serviceTargetName,
+            true,
+            false);
 
         // create service role
-        string memory serviceRoleName = string(
-            abi.encodePacked(
-                baseName,
-                "ServiceRole",
-                versionName,
-                versionNumber));
-
-        RoleId roleId = RoleIdLib.roleForTypeAndVersion(
-            domain, 
+        RoleId serviceRoleId = RoleIdLib.roleForTypeAndVersion(
+            serviceDomain, 
             version);
 
         _createRole(
-            roleId, 
-            ADMIN_ROLE(), 
-            serviceRoleName,
-            1, // service roles must only be given to this unique service
-            true); // it must not be possible to remove this role once granted
+            serviceRoleId, 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: 1,
+                name: ObjectTypeLib.toVersionedName(
+                    baseName, 
+                    "ServiceRole", 
+                    versionInt)}));
 
         _grantRoleToAccount( 
-            roleId,
+            serviceRoleId,
             address(service)); 
     }
 
@@ -186,7 +179,7 @@ contract RegistryAdmin is
             }
 
             // get authorized functions for authorized domain
-            IAccessAdmin.Function[] memory authorizatedFunctions = serviceAuthorization.getAuthorizedFunctions(
+            IAccess.FunctionInfo[] memory authorizatedFunctions = serviceAuthorization.getAuthorizedFunctions(
                 serviceDomain, 
                 authorizedDomain);
 
@@ -218,27 +211,38 @@ contract RegistryAdmin is
     //--- private functions -------------------------------------------------//
 
     function _setupGifAdminRole(address gifAdmin) private {
-        // TODO decide on max member count
-        _createRole(GIF_ADMIN_ROLE(), getAdminRole(), GIF_ADMIN_ROLE_NAME, 2, false);
-        _grantRoleToAccount(GIF_ADMIN_ROLE(), gifAdmin);
+        
+        _createRole(
+            GIF_ADMIN_ROLE(), 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Gif,
+                maxMemberCount: 2, // TODO decide on max member count
+                name: GIF_ADMIN_ROLE_NAME}));
 
         // for ReleaseManager
-        Function[] memory functions;
-        functions = new Function[](2);
+        FunctionInfo[] memory functions;
+        functions = new FunctionInfo[](2);
         functions[0] = toFunction(ReleaseManager.createNextRelease.selector, "createNextRelease");
         functions[1] = toFunction(ReleaseManager.activateNextRelease.selector, "activateNextRelease");
         _authorizeTargetFunctions(_releaseManager, GIF_ADMIN_ROLE(), functions);
 
-        // for Staking
+        _grantRoleToAccount(GIF_ADMIN_ROLE(), gifAdmin);
     }
     
     function _setupGifManagerRole(address gifManager) private {
-        _createRole(GIF_MANAGER_ROLE(), GIF_ADMIN_ROLE(), GIF_MANAGER_ROLE_NAME, 1, false);
-        _grantRoleToAccount(GIF_MANAGER_ROLE(), gifManager);
+
+        _createRole(
+            GIF_MANAGER_ROLE(), 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Gif,
+                maxMemberCount: 1,
+                name: GIF_MANAGER_ROLE_NAME}));
 
         // for TokenRegistry
-        Function[] memory functions;
-        functions = new Function[](5);
+        FunctionInfo[] memory functions;
+        functions = new FunctionInfo[](5);
         functions[0] = toFunction(TokenRegistry.registerToken.selector, "registerToken");
         functions[1] = toFunction(TokenRegistry.registerRemoteToken.selector, "registerRemoteToken");
         functions[2] = toFunction(TokenRegistry.setActive.selector, "setActive");
@@ -248,41 +252,54 @@ contract RegistryAdmin is
         _authorizeTargetFunctions(_tokenRegistry, GIF_MANAGER_ROLE(), functions);
 
         // for ReleaseManager
-        functions = new Function[](2);
+        functions = new FunctionInfo[](2);
         functions[0] = toFunction(ReleaseManager.prepareNextRelease.selector, "prepareNextRelease");
         functions[1] = toFunction(ReleaseManager.registerService.selector, "registerService");
         _authorizeTargetFunctions(_releaseManager, GIF_MANAGER_ROLE(), functions);
 
-        // for Staking
+        _grantRoleToAccount(GIF_MANAGER_ROLE(), gifManager);
     }
 
 
     function _setupReleaseManager() private {
-        _createTarget(_releaseManager, RELEASE_MANAGER_TARGET_NAME);
 
-        RoleId releaseManagerRoleId = RoleIdLib.roleForType(RELEASE());
-        _createRole(releaseManagerRoleId, ADMIN_ROLE(), RELEASE_MANAGER_TARGET_NAME, 1, true);
-        _grantRoleToAccount(releaseManagerRoleId, _releaseManager);
+        _createTarget(_releaseManager, RELEASE_MANAGER_TARGET_NAME, true, false);
 
-        Function[] memory functions;
-        functions = new Function[](2);
+        RoleId releaseManagerRoleId = RoleIdLib.roleForType(RELEASE());
+        _createRole(
+            releaseManagerRoleId, 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: 1,
+                name: RELEASE_MANAGER_ROLE_NAME}));
+
+        FunctionInfo[] memory functions;
+        functions = new FunctionInfo[](2);
         functions[0] = toFunction(RegistryAdmin.authorizeService.selector, "authorizeService");
         functions[1] = toFunction(RegistryAdmin.grantServiceRoleForAllVersions.selector, "grantServiceRoleForAllVersions");
         _authorizeTargetFunctions(address(this), releaseManagerRoleId, functions);
+
+        _grantRoleToAccount(releaseManagerRoleId, _releaseManager);
     }
 
 
     function _setupStaking() private {
-        _createTarget(_staking, STAKING_TARGET_NAME);
-        _createTarget(_stakingStore, STAKING_STORE_TARGET_NAME);
-
+        _createTarget(_staking, STAKING_TARGET_NAME, true, false);
+        _createTarget(_stakingStore, STAKING_STORE_TARGET_NAME, true, false);
 
         // staking function authorization for staking service
         RoleId stakingServiceRoleId = RoleIdLib.roleForTypeAndAllVersions(STAKING());
-        _createRole(stakingServiceRoleId, ADMIN_ROLE(), STAKING_SERVICE_ROLE_NAME, 1, true);
-
-        Function[] memory functions;
-        functions = new Function[](13);
+        _createRole(
+            stakingServiceRoleId, 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: MAX_NUM_RELEASES,
+                name: STAKING_SERVICE_ROLE_NAME}));
+
+        FunctionInfo[] memory functions;
+        functions = new FunctionInfo[](13);
         functions[0] = toFunction(IStaking.registerTarget.selector, "registerTarget");
         functions[1] = toFunction(IStaking.setLockingPeriod.selector, "setLockingPeriod");
         functions[2] = toFunction(IStaking.setRewardRate.selector, "setRewardRate");
@@ -300,20 +317,31 @@ contract RegistryAdmin is
 
         // staking function authorization for pool service
         RoleId poolServiceRoleId = RoleIdLib.roleForTypeAndAllVersions(POOL());
-        _createRole(poolServiceRoleId, ADMIN_ROLE(), POOL_SERVICE_ROLE_NAME, 1, true);
+        _createRole(
+            poolServiceRoleId, 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: MAX_NUM_RELEASES,
+                name: POOL_SERVICE_ROLE_NAME}));
 
         // staking function authorizations
-        functions = new Function[](2);
+        functions = new FunctionInfo[](2);
         functions[0] = toFunction(IStaking.increaseTotalValueLocked.selector, "increaseTotalValueLocked");
         functions[1] = toFunction(IStaking.decreaseTotalValueLocked.selector, "decreaseTotalValueLocked");
         _authorizeTargetFunctions(_staking, poolServiceRoleId, functions);
 
         // staking store function authorizations
         RoleId stakingRoleId = RoleIdLib.roleForType(STAKING());
-        _createRole(stakingRoleId, ADMIN_ROLE(), STAKING_TARGET_NAME, 1, true);
-        _grantRoleToAccount(stakingRoleId, _staking);
-
-        functions = new Function[](14);
+        _createRole(
+            stakingRoleId, 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: 1,
+                name: STAKING_ROLE_NAME}));
+
+        functions = new FunctionInfo[](14);
         functions[0] = toFunction(StakingStore.setStakingRate.selector, "setStakingRate");
         functions[1] = toFunction(StakingStore.createTarget.selector, "createTarget");
         functions[2] = toFunction(StakingStore.updateTarget.selector, "updateTarget");
@@ -329,5 +357,7 @@ contract RegistryAdmin is
         functions[12] = toFunction(StakingStore.claimUpTo.selector, "claimUpTo");
         functions[13] = toFunction(StakingStore.unstakeUpTo.selector, "unstakeUpTo");
         _authorizeTargetFunctions(_stakingStore, stakingRoleId, functions);
+
+        _grantRoleToAccount(stakingRoleId, _staking);
     }
 }

package/contracts/registry/ReleaseManager.sol

@@ -18,7 +18,6 @@ import {StateId, INITIAL, SCHEDULED, DEPLOYING, ACTIVE} from "../type/StateId.so
 import {Version, VersionLib, VersionPart, VersionPartLib} from "../type/Version.sol";
 
 import {IService} from "../shared/IService.sol";
-import {AccessManagerExtendedWithDisableInitializeable} from "../shared/AccessManagerExtendedWithDisableInitializeable.sol";
 import {ILifecycle} from "../shared/ILifecycle.sol";
 import {INftOwnable} from "../shared/INftOwnable.sol";
 import {IRegisterable} from "../shared/IRegisterable.sol";
@@ -26,13 +25,14 @@ import {IRegisterable} from "../shared/IRegisterable.sol";
 import {IRegistry} from "./IRegistry.sol";
 import {IRegistryLinked} from "../shared/IRegistryLinked.sol";
 import {IRegistryService} from "./IRegistryService.sol";
-import {IServiceAuthorization} from "./IServiceAuthorization.sol";
-import {IAccessAdmin} from "../shared/IAccessAdmin.sol";
+import {IServiceAuthorization} from "../authorization/IServiceAuthorization.sol";
+import {IAccessAdmin} from "../authorization/IAccessAdmin.sol";
 import {RegistryAdmin} from "./RegistryAdmin.sol";
 import {Registry} from "./Registry.sol";
 import {TokenRegistry} from "./TokenRegistry.sol";
 
-
+// TODO rename to something that does not end with 'Manager' 
+// everywhere else *Manager points to an upgradeable contract
 contract ReleaseManager is 
     AccessManaged, 
     ILifecycle, 
@@ -92,17 +92,19 @@ contract ReleaseManager is
     Seconds public constant MIN_DISABLE_DELAY = Seconds.wrap(60 * 24 * 365); // 1 year
 
     RegistryAdmin public immutable _admin;
-    address public immutable _releaseAccessManagerCodeAddress;
     Registry public immutable _registry;
     IRegisterable private _staking;
     address private _stakingOwner;
 
-    // TODO remove once it's clear that release authority will always be registry authority
-    mapping(VersionPart version => address authority) internal _releaseAccessManager;
     mapping(VersionPart version => IRegistry.ReleaseInfo info) internal _releaseInfo;
+    mapping(VersionPart version => IServiceAuthorization authz) internal _serviceAuthorization;
+
+    // TODO check where/why this is used
     mapping(address registryService => VersionPart version) _releaseVersionByAddress;
 
-    mapping(VersionPart version => IServiceAuthorization authz) internal _serviceAuthorization;
+    // TODO remove once it's clear that release authority will always be registry authority
+    mapping(VersionPart version => address authority) internal _releaseAccessManager;
+
 
     VersionPart immutable internal _initial;// first active version    
     VersionPart internal _latest; // latest active version
@@ -128,11 +130,6 @@ contract ReleaseManager is
         _initial = VersionPartLib.toVersionPart(INITIAL_GIF_VERSION);
         _next = VersionPartLib.toVersionPart(INITIAL_GIF_VERSION - 1);
         _state = getInitialState(RELEASE());
-        
-        AccessManagerExtendedWithDisableInitializeable masterReleaseAccessManager = new AccessManagerExtendedWithDisableInitializeable();
-        masterReleaseAccessManager.initialize(_registry.NFT_LOCK_ADDRESS(), VersionLib.toVersionPart(0));
-        //masterReleaseAccessManager.disable();
-        _releaseAccessManagerCodeAddress = address(masterReleaseAccessManager);
     }
 
     /// @dev skips previous release if was not activated
@@ -166,35 +163,36 @@ contract ReleaseManager is
             bytes32 releaseSalt
         )
     {
-        // TODO Any call to serviceAuthorization contract must be treated as a call to an external malicious contract
-        // How can wrong authorizations tamper the core, releases or instances?
-        (
-            VersionPart releaseVersion,
-            uint serviceDomainsCount
-        ) = serviceAuthorization.getRelease();
+        // verify release manager is in proper state to start deploying a next release
+        if (!isValidTransition(RELEASE(), _state, DEPLOYING())) {
+            revert ErrorReleaseManagerReleasePreparationDisallowed(_state);
+        }
+
+        // verify prepareNextRelease is only called once per release
+        if(_servicesToRegister > 0) {
+            revert ErrorReleaseManagerReleaseAlreadyPrepared(version);
+        }
 
         // verify authorizaion contract release matches with expected version
+        VersionPart releaseVersion = serviceAuthorization.getRelease();
         if (releaseVersion != _next) {
             revert ErrorReleaseManagerVersionMismatch(_next, releaseVersion);
         }
 
         // sanity check to ensure service domain list is not empty
+        uint256 serviceDomainsCount = serviceAuthorization.getServiceDomains().length;
         if (serviceDomainsCount == 0) {
             revert ErrorReleaseManagerNoDomains(_next);
         }
 
-        // verify release manager is in proper state to start deploying a next release
-        if (!isValidTransition(RELEASE(), _state, DEPLOYING())) {
-            revert ErrorReleaseManagerReleasePreparationDisallowed(_state);
-        }
-
-        // verify prepareNextRelease is only called once per release
-        if(_servicesToRegister > 0) {
-            revert ErrorReleaseManagerReleaseAlreadyPrepared(version);
-        }
+        _state = DEPLOYING();
+        _servicesToRegister = serviceDomainsCount;
 
         // store release specific service authorization
+        authority = _admin.authority();
         _serviceAuthorization[_next] = serviceAuthorization;
+        // TODO refactor: authority no longer release specific
+        _releaseAccessManager[_next] = authority;
 
         // ensures unique salt
         releaseSalt = keccak256(
@@ -202,13 +200,6 @@ contract ReleaseManager is
                 bytes32(version.toInt()),
                 salt));
 
-        authority = _admin.authority();
-
-        _releaseAccessManager[_next] = authority;
-        _servicesToRegister = serviceDomainsCount;
-
-        _state = DEPLOYING();
-
         emit LogReleaseCreation(version, releaseSalt, authority);
     }
 
@@ -238,9 +229,6 @@ contract ReleaseManager is
             revert ErrorReleaseManagerServiceDomainMismatch(expectedDomain, service.getDomain());
         }
 
-        // checked in registry
-        _releaseInfo[version].domains.push(domain);
-
         // register service with registry
         nftId = _registry.registerService(info, version, domain);
         _registeredServices++;
@@ -383,9 +371,12 @@ contract ReleaseManager is
         return _servicesToRegister - _registeredServices;
     }
 
-    // TODO cleanup
-    function getReleaseAccessManager(VersionPart version) external view returns(AccessManagerExtendedWithDisableInitializeable) {
-        // return _releaseAccessManager[version];
+    function getServiceAuthorization(VersionPart version)
+        external
+        view
+        returns (IServiceAuthorization serviceAuthorization)
+    {
+        return _serviceAuthorization[version];
     }
 
     // TODO token registry knows nothing about adfmin, only registry

package/contracts/registry/ServiceAuthorizationV3.sol

@@ -6,7 +6,7 @@ import {
 } from "../../contracts/type/ObjectType.sol";
 
 import {ComponentService} from "../shared/ComponentService.sol";
-import {IAccessAdmin} from "../shared/IAccessAdmin.sol";
+import {IAccess} from "../authorization/IAccess.sol";
 import {IBundleService} from "../pool/IBundleService.sol";
 import {IDistributionService} from "../distribution/IDistributionService.sol";
 import {InstanceService} from "../instance/InstanceService.sol";
@@ -14,7 +14,7 @@ import {IInstanceService} from "../instance/IInstanceService.sol";
 import {IPoolService} from "../pool/IPoolService.sol";
 import {IStakingService} from "../staking/IStakingService.sol";
 import {IRegistryService} from "./IRegistryService.sol";
-import {ServiceAuthorization} from "./ServiceAuthorization.sol";
+import {ServiceAuthorization} from "../authorization/ServiceAuthorization.sol";
 
 
 contract ServiceAuthorizationV3
@@ -64,7 +64,7 @@ contract ServiceAuthorizationV3
      function _setupIRegistryServiceAuthorization()
           internal
      {
-          IAccessAdmin.Function[] storage functions;
+          IAccess.FunctionInfo[] storage functions;
 
           functions = _authorizeForService(REGISTRY(), APPLICATION());
           _authorize(functions, IRegistryService.registerPolicy.selector, "registerPolicy");
@@ -98,7 +98,7 @@ contract ServiceAuthorizationV3
      function _setupStakingServiceAuthorization()
           internal
      {
-          IAccessAdmin.Function[] storage functions;
+          IAccess.FunctionInfo[] storage functions;
 
           functions = _authorizeForService(STAKING(), INSTANCE());
           _authorize(functions, IStakingService.createInstanceTarget.selector, "createInstanceTarget");
@@ -121,10 +121,10 @@ contract ServiceAuthorizationV3
      function _setupInstanceServiceAuthorization()
           internal
      {
-          IAccessAdmin.Function[] storage functions;
+          IAccess.FunctionInfo[] storage functions;
 
           functions = _authorizeForService(INSTANCE(), COMPONENT());
-          _authorize(functions, IInstanceService.createComponentTarget.selector, "createComponentTarget");
+          _authorize(functions, IInstanceService.initializeAuthorization.selector, "initializeAuthorization");
      }
 
 
@@ -159,7 +159,7 @@ contract ServiceAuthorizationV3
      function _setupDistributionServiceAuthorization()
           internal
      {
-          IAccessAdmin.Function[] storage functions;
+          IAccess.FunctionInfo[] storage functions;
 
           functions = _authorizeForService(DISTRIBUTION(), POLICY());
           _authorize(functions, IDistributionService.processSale.selector, "processSale");
@@ -170,7 +170,7 @@ contract ServiceAuthorizationV3
      function _setupPoolServiceAuthorization()
           internal
      {
-          IAccessAdmin.Function[] storage functions;
+          IAccess.FunctionInfo[] storage functions;
 
           functions = _authorizeForService(POOL(), POLICY());
           _authorize(functions, IPoolService.lockCollateral.selector, "lockCollateral");
@@ -187,7 +187,7 @@ contract ServiceAuthorizationV3
      function _setupBundleServiceAuthorization()
           internal
      {
-          IAccessAdmin.Function[] storage functions;
+          IAccess.FunctionInfo[] storage functions;
 
           functions = _authorizeForService(BUNDLE(), POOL());
           _authorize(functions, IBundleService.create.selector, "create");