@etherisc/gif-next 0.0.2-8459327 → 0.0.2-8469187-381

package/contracts/instance/Instance.sol

@@ -1,64 +1,351 @@
 // SPDX-License-Identifier: Apache-2.0
-pragma solidity ^0.8.19;
+pragma solidity ^0.8.20;
 
-import {Registerable} from "../registry/Registry.sol";
+import {IAccess} from "../authorization/IAccess.sol";
+import {IInstance} from "./IInstance.sol";
+import {IComponentService} from "../shared/IComponentService.sol";
+import {IInstanceService} from "./IInstanceService.sol";
 import {IRegistry} from "../registry/IRegistry.sol";
 
-import {IAccessModule, AccessModule} from "./access/Access.sol";
-import {ComponentModule} from "./component/ComponentModule.sol";
-import {ProductModule} from "./product/ProductService.sol";
-import {PolicyModule} from "./policy/PolicyModule.sol";
-import {PoolModule} from "./pool/PoolModule.sol";
-
-import {IInstance} from "./IInstance.sol";
-import {NftId, toNftId} from "../types/NftId.sol";
+import {Amount} from "../type/Amount.sol";
+import {BundleSet} from "./BundleSet.sol";
+import {RiskSet} from "./RiskSet.sol";
+import {COMPONENT, INSTANCE} from "../type/ObjectType.sol";
+import {InstanceReader} from "./InstanceReader.sol";
+import {InstanceAdmin} from "./InstanceAdmin.sol";
+import {InstanceStore} from "./InstanceStore.sol";
+import {NftId} from "../type/NftId.sol";
+import {ProductStore} from "./ProductStore.sol";
+import {Registerable} from "../shared/Registerable.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {Seconds} from "../type/Seconds.sol";
+import {UFixed} from "../type/UFixed.sol";
+import {VersionPart} from "../type/Version.sol";
 
 contract Instance is
-    Registerable,
-    AccessModule,
-    ComponentModule,
-    PolicyModule,
-    PoolModule,
-    ProductModule,
-    IInstance
+    IInstance,
+    Registerable
 {
-    constructor(
-        address registry,
-        address componentOwnerService,
-        address productService
+    bool private _initialized;
+
+    IComponentService internal _componentService;
+    IInstanceService internal _instanceService;
+
+    InstanceAdmin internal _instanceAdmin;
+    InstanceReader internal _instanceReader;
+    BundleSet internal _bundleSet;
+    RiskSet internal _riskSet;
+    InstanceStore internal _instanceStore;
+    ProductStore internal _productStore;
+    NftId [] internal _products;
+    bool internal _tokenRegistryDisabled;
+
+
+    modifier onlyCustomRoleAdmin(RoleId roleId) {
+        if (!_instanceAdmin.isRoleCustom(roleId)) {
+            revert ErrorInstanceNotCustomRole(roleId);
+        }
+
+        // instance owner can always act as role admin
+        address account = msg.sender;
+        if (account != getOwner()) {
+            if (!_instanceAdmin.isRoleAdmin(roleId, account)) {
+                revert ErrorInstanceNotRoleAdmin(roleId, account);
+            }
+        }
+        _;
+    }
+
+
+    function initialize(
+        InstanceContracts memory instanceContracts,
+        IRegistry registry, 
+        VersionPart release,
+        address initialOwner,
+        bool tokenRegistryDisabled // only disable for testing
+    ) 
+        external 
+        initializer()
+    {
+        if(address(instanceContracts.instanceAdmin) == address(0)) {
+            revert ErrorInstanceInstanceAdminZero();
+        }
+
+        _instanceAdmin = instanceContracts.instanceAdmin;
+
+        // setup instance object info
+        __Registerable_init({
+            authority: instanceContracts.instanceAdmin.authority(),
+            registry: address(registry), 
+            parentNftId: registry.getNftId(), 
+            objectType: INSTANCE(), 
+            isInterceptor: false, 
+            initialOwner: initialOwner, 
+            data: ""});
+
+        // store instance supporting contracts
+        _instanceStore = instanceContracts.instanceStore;
+        _productStore = instanceContracts.productStore;
+        _bundleSet = instanceContracts.bundleSet;
+        _riskSet = instanceContracts.riskSet;
+        _instanceReader = instanceContracts.instanceReader;
+
+        // initialize instance supporting contracts
+        _instanceStore.initialize();
+        _productStore.initialize();
+        _bundleSet.initialize(instanceContracts.instanceAdmin.authority(), address(registry));
+        _riskSet.initialize(instanceContracts.instanceAdmin.authority(), address(registry));
+        _instanceReader.initialize();
+
+        _componentService = IComponentService(
+            getRegistry().getServiceAddress(
+                COMPONENT(), 
+                release));
+
+        _instanceService = IInstanceService(
+            getRegistry().getServiceAddress(
+                INSTANCE(), 
+                release));
+
+        _tokenRegistryDisabled = tokenRegistryDisabled;
+
+        _registerInterface(type(IInstance).interfaceId);    
+    }
+
+
+    function setInstanceLocked(bool locked)
+        external 
+        // not restricted(): need to be able to unlock a locked instance
+        onlyOwner()
+    {
+        _instanceService.setInstanceLocked(locked);
+    }
+
+
+    function upgradeInstanceReader()
+        external
+        restricted()
+        onlyOwner()
+    {
+        _instanceService.upgradeInstanceReader();
+    }
+
+
+    //--- ProductRegistration ----------------------------------------------//
+
+    function registerProduct(address product, address token)
+        external
+        restricted()
+        onlyOwner()
+        returns (NftId productNftId)
+    {
+        productNftId = _componentService.registerProduct(product, token);
+        _products.push(productNftId);
+    }
+
+    //--- Staking ----------------------------------------------------------//
+
+    function setStakingLockingPeriod(Seconds stakeLockingPeriod)
+        external
+        restricted()
+        onlyOwner()
+    {
+        _instanceService.setStakingLockingPeriod(stakeLockingPeriod);
+    }
+
+    function setStakingRewardRate(UFixed rewardRate)
+        external
+        restricted()
+        onlyOwner()
+    {
+        _instanceService.setStakingRewardRate(rewardRate);
+    }
+
+    function setStakingMaxAmount(Amount maxStakedAmount)
+        external
+        restricted()
+        onlyOwner()
+    {
+        _instanceService.setStakingMaxAmount(maxStakedAmount);
+    }
+
+    function refillStakingRewardReserves(Amount dipAmount)
+        external
+        restricted()
+        onlyOwner()
+        returns (Amount newRewardReserveBalance)
+    {
+        address instanceOwner = msg.sender;
+        return _instanceService.refillInstanceRewardReserves(instanceOwner, dipAmount);
+    }
+
+    function withdrawStakingRewardReserves(Amount dipAmount)
+        external
+        restricted()
+        onlyOwner()
+        returns (Amount newRewardReserveBalance)
+    {
+        return _instanceService.withdrawInstanceRewardReserves(dipAmount);
+    }
+
+    //--- Roles ------------------------------------------------------------//
+
+    /// @inheritdoc IInstance
+    function createRole(
+        string memory roleName, 
+        RoleId adminRoleId,
+        uint32 maxMemberCount
     )
-        Registerable(registry)
-        AccessModule()
-        ComponentModule(componentOwnerService)
-        PolicyModule(productService)
-        ProductModule(productService)
-        PoolModule(productService)
-    {}
+        external
+        restricted()
+        onlyOwner()
+        returns (RoleId roleId)
+    {
+        roleId = _instanceService.createRole(roleName, adminRoleId, maxMemberCount);
+        emit LogInstanceCustomRoleCreated(roleId, roleName, adminRoleId, maxMemberCount);
+    }
+
+
+    /// @inheritdoc IInstance
+    function setRoleActive(RoleId roleId, bool active)
+        external 
+        restricted()
+        onlyCustomRoleAdmin(roleId)
+    {
+        _instanceService.setRoleActive(roleId, active);
+        emit LogInstanceCustomRoleActiveSet(roleId, active, msg.sender);
+    }
+
+
+    /// @inheritdoc IInstance
+    function grantRole(RoleId roleId, address account) 
+        external 
+        restricted()
+        onlyCustomRoleAdmin(roleId)
+    {
+        _instanceService.grantRole(roleId, account);
+        emit LogInstanceCustomRoleGranted(roleId, account, msg.sender);
+    }
+
+
+    /// @inheritdoc IInstance
+    function revokeRole(RoleId roleId, address account) 
+        external 
+        restricted()
+        onlyCustomRoleAdmin(roleId)
+    {
+        _instanceService.revokeRole(roleId, account);
+        emit LogInstanceCustomRoleRevoked(roleId, account, msg.sender);
+    }
+
+    //--- Targets ------------------------------------------------------------//
+
+    /// @inheritdoc IInstance
+    function createTarget(address target, string memory name) 
+        external 
+        restricted()
+        onlyOwner()
+        returns (RoleId targetRoleId)
+    {
+        targetRoleId = _instanceService.createTarget(target, name);
+        emit LogInstanceCustomTargetCreated(target, targetRoleId, name);
+    }
+
+
+    /// @inheritdoc IInstance
+    function setTargetLocked(address target, bool locked)
+        external 
+        // not restricted(): instance owner may need to be able to unlock targets on an locked instance
+        onlyOwner()
+    {
+        _instanceService.setTargetLocked(target, locked);
+        emit LogInstanceTargetLocked(target, locked);
+    }
+
+
+    /// @inheritdoc IInstance
+    function authorizeFunctions(
+        address target, 
+        RoleId roleId, 
+        IAccess.FunctionInfo[] memory functions
+    )
+        external 
+        restricted()
+        onlyOwner()
+    {
+        _instanceService.authorizeFunctions(target, roleId, functions);
+    }
+
+
+    /// @inheritdoc IInstance
+    function unauthorizeFunctions(
+        address target, 
+        IAccess.FunctionInfo[] memory functions
+    )
+        external 
+        restricted()
+        onlyOwner()
+    {
+        _instanceService.unauthorizeFunctions(target, functions);
+    }
+
+    //--- initial setup functions -------------------------------------------//
+
+
+    function setInstanceReader(InstanceReader instanceReader)
+        external
+        restricted()
+    {
+        if(instanceReader.getInstance() != Instance(this)) {
+            revert ErrorInstanceInstanceReaderInstanceMismatch(address(this));
+        }
+
+        _instanceReader = instanceReader;
+    }
+
+    //--- external view functions -------------------------------------------//
+
+    function isInstanceLocked() external view returns (bool) {
+        return _instanceAdmin.isLocked();
+    }
+
+    function isTargetLocked(address target) external view returns (bool) {
+        return _instanceAdmin.isTargetLocked(target);
+    }
+
+    function products() external view returns (uint256 productCount) {
+        return _products.length;
+    }
+
+    function getProductNftId(uint256 idx) external view returns (NftId productNftId) {
+        return _products[idx];
+    }
+
+    function getInstanceReader() external view returns (InstanceReader) {
+        return _instanceReader;
+    }
+
+    function getBundleSet() external view returns (BundleSet) {
+        return _bundleSet;
+    }
+
+    function getRiskSet() external view returns (RiskSet) {
+        return _riskSet;
+    }
 
-    // from registerable
-    function register() external override returns (NftId nftId) {
-        require(
-            address(_registry) != address(0),
-            "ERROR:PRD-001:REGISTRY_ZERO"
-        );
-        return _registry.register(address(this));
+    function getInstanceAdmin() external view returns (InstanceAdmin) {
+        return _instanceAdmin;
     }
 
-    // from registerable
-    function getParentNftId() public view override returns (NftId) {
-        // TODO  add self registry and exchange 0 for_registry.getNftId();
-        // define parent tree for all registerables
-        // eg 0 <- chain(mainnet) <- global registry <- chain registry <- instance <- component <- policy/bundle
-        return toNftId(0);
+    function getInstanceStore() external view returns (InstanceStore) {
+        return _instanceStore;
     }
 
-    // from registerable
-    function getType() external view override returns (uint256 objectType) {
-        return _registry.INSTANCE();
+    function getProductStore() external view returns (ProductStore) {
+        return _productStore;
     }
 
-    // from registerable
-    function getData() external view override returns (bytes memory data) {
-        return bytes(abi.encode(0));
+    function isTokenRegistryDisabled() external view returns (bool) {
+        return _tokenRegistryDisabled;
     }
-}
+}

package/contracts/instance/InstanceAdmin.sol

@@ -0,0 +1,307 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import {IAccess} from "../authorization/IAccess.sol";
+import {IAuthorization} from "../authorization/IAuthorization.sol";
+import {IRegistry} from "../registry/IRegistry.sol";
+import {IInstance} from "./IInstance.sol";
+
+import {AccessAdmin} from "../authorization/AccessAdmin.sol";
+import {AccessAdminLib} from "../authorization/AccessAdminLib.sol";
+import {AccessManagerCloneable} from "../authorization/AccessManagerCloneable.sol";
+import {ObjectType, INSTANCE} from "../type/ObjectType.sol";
+import {RoleId, ADMIN_ROLE} from "../type/RoleId.sol";
+import {Str} from "../type/String.sol";
+import {VersionPart} from "../type/Version.sol";
+import {INSTANCE_TARGET_NAME, INSTANCE_ADMIN_TARGET_NAME, INSTANCE_STORE_TARGET_NAME, PRODUCT_STORE_TARGET_NAME, BUNDLE_SET_TARGET_NAME, RISK_SET_TARGET_NAME} from "./TargetNames.sol";
+
+
+contract InstanceAdmin is
+    AccessAdmin
+{
+    // onlyInstanceService
+    error ErrorInstanceAdminNotInstanceService(address caller);
+
+    // authorizeFunctions
+    error ErrorInstanceAdminNotComponentOrCustomTarget(address target);
+
+    IInstance internal _instance;
+    IRegistry internal _registry;
+
+    uint64 internal _customRoleIdNext;
+
+
+    modifier onlyInstanceService() {
+        if (msg.sender != _registry.getServiceAddress(INSTANCE(), getRelease())) {
+            revert ErrorInstanceAdminNotInstanceService(msg.sender);
+        }
+        _;
+    }
+
+
+    /// @dev Only used for master instance admin.
+    constructor(address accessManager) {
+        initialize(
+            accessManager,
+            "MasterInstanceAdmin");
+    }
+
+
+    /// @dev Completes the initialization of this instance admin using the provided instance, registry and version.
+    /// Important: Initialization of instance admin is only complete after calling this function. 
+    /// Important: The instance MUST be registered and all instance supporting contracts must be wired to this instance.
+    function completeSetup(
+        address registry,
+        address authorization,
+        VersionPart release,
+        address instance
+    )
+        external
+        reinitializer(uint64(release.toInt()))
+    {
+        // checks
+        AccessAdminLib.checkIsRegistered(registry, instance, INSTANCE());
+
+        // effects
+        AccessManagerCloneable(
+            authority()).completeSetup(
+                registry, 
+                release); 
+
+        AccessAdminLib.checkAuthorization(
+            address(_authorization), 
+            authorization, 
+            INSTANCE(), // expectedDomain
+            release, // expectedRelease
+            false, // expectServiceAuthorization
+            true); // checkAlreadyInitialized
+
+        _registry = IRegistry(registry);
+        _instance = IInstance(instance);
+        _authorization = IAuthorization(authorization);
+        _customRoleIdNext = 0;
+
+        // link nft ownability to instance
+        _linkToNftOwnable(instance);
+
+        // setup roles and services
+        _createRoles(_authorization);
+        _setupServices(_authorization);
+
+        // setup instance targets
+        _createInstanceTargets(_authorization.getMainTargetName());
+
+        // authorize functions of instance contracts
+        _createTargetAuthorizations(_authorization);
+    }
+
+    /// @dev grants the service roles to the service addresses based on the authorization specification.
+    /// Service addresses used for the granting are determined by the registry and the release of this instance.
+    function _setupServices(IAuthorization authorization)
+        internal
+    {
+        ObjectType[] memory serviceDomains = authorization.getServiceDomains();
+
+        for(uint256 i = 0; i < serviceDomains.length; i++) {
+            ObjectType serviceDomain = serviceDomains[i];
+            RoleId serviceRoleId = authorization.getServiceRole(serviceDomain);
+            address service = _registry.getServiceAddress(serviceDomain, getRelease());
+
+            _grantRoleToAccount(
+                serviceRoleId,
+                service);
+        }
+    }
+
+
+    function _createInstanceTargets(string memory instanceTargetName)
+        internal
+    {
+        _createInstanceTarget(address(_instance), instanceTargetName); 
+        _createInstanceTarget(address(this), INSTANCE_ADMIN_TARGET_NAME); 
+        _createInstanceTarget(address(_instance.getInstanceStore()), INSTANCE_STORE_TARGET_NAME); 
+        _createInstanceTarget(address(_instance.getProductStore()), PRODUCT_STORE_TARGET_NAME); 
+        _createInstanceTarget(address(_instance.getBundleSet()), BUNDLE_SET_TARGET_NAME); 
+        _createInstanceTarget(address(_instance.getRiskSet()), RISK_SET_TARGET_NAME); 
+    }
+
+
+    function _createInstanceTarget(address target, string memory name) internal {
+        _createTarget(target, name, TargetType.Instance, true); 
+    }
+
+
+    /// @dev Initializes the authorization for the specified component.
+    /// Important: The component MUST be registered.
+    function initializeComponentAuthorization(
+        address componentAddress,
+        ObjectType expectedType
+    )
+        external
+        restricted()
+    {
+        IAuthorization authorization = AccessAdminLib.checkComponentInitialization(
+            this, _authorization, componentAddress, expectedType);
+
+        // effects
+        _createRoles(authorization);
+        _createTarget(componentAddress, authorization.getMainTargetName(), TargetType.Component, true);
+        _createTargetAuthorizations(authorization);
+    }
+
+
+    /// @dev Creates a custom role.
+    function createRole(
+        string memory name,
+        RoleId adminRoleId,
+        uint32 maxMemberCount
+    )
+        external
+        restricted()
+        returns (RoleId roleId)
+    {
+        // create roleId
+        roleId = AccessAdminLib.getCustomRoleId(_customRoleIdNext++);
+
+        // create role
+        _createRole(
+            roleId, 
+            AccessAdminLib.roleInfo(
+                adminRoleId, 
+                IAccess.TargetType.Custom, 
+                maxMemberCount, 
+                name),
+            true); // revert on existing role
+    }
+
+
+    /// @dev Activtes/pauses the specified role.
+    function setRoleActive(RoleId roleId, bool active)
+        external
+        restricted()
+    {
+        _setRoleActive(roleId, active);
+    }
+
+
+    /// @dev Grants the provided role to the specified account
+    function grantRole(
+        RoleId roleId, 
+        address account)
+        external
+        restricted()
+    {
+        _grantRoleToAccount(roleId, account);
+    }
+
+
+    /// @dev Revokes the provided role from the specified account
+    function revokeRole(
+        RoleId roleId, 
+        address account)
+        external
+        restricted()
+    {
+        _revokeRoleFromAccount(roleId, account);
+    }
+
+
+    /// @dev Create a new contract target.
+    /// The target needs to be an access managed contract.
+    function createTarget(
+        address target, 
+        string memory name
+    )
+        external
+        restricted()
+        returns (RoleId contractRoleId)
+    {
+        return _createTarget(
+            target, 
+            name, 
+            TargetType.Contract,
+            true); // check authority matches
+    }
+
+
+    /// @dev Add function authorizations for the specified component or custom target.
+    function authorizeFunctions(
+        address target,
+        RoleId roleId,
+        IAccess.FunctionInfo[] memory functions
+    )
+        external
+        restricted()
+    {
+        _authorizeTargetFunctions(target, roleId, functions, true, true);
+    }
+
+
+    /// @dev Removes function authorizations for the specified component or custom target.
+    function unauthorizeFunctions(
+        address target,
+        IAccess.FunctionInfo[] memory functions
+    )
+        external
+        restricted()
+    {
+        _authorizeTargetFunctions(target, ADMIN_ROLE(), functions, true, false);
+    }
+
+
+    /// @dev locks the instance and all its releated targets including component and custom targets.
+    function setInstanceLocked(bool locked)
+        external
+        // not restricted(): need to operate on locked instances to unlock instance
+        onlyInstanceService()
+    {
+        AccessManagerCloneable accessManager = AccessManagerCloneable(authority());
+        accessManager.setLocked(locked);
+    }
+
+
+    function setTargetLocked(address target, bool locked) 
+        external 
+        // not restricted(): need to operate on locked instances to unlock instance
+        onlyInstanceService()
+    {
+        _setTargetLocked(target, locked);
+    }
+
+
+    function setContractLocked(address target, bool locked) 
+        external 
+        restricted() // component service
+    {
+        _setTargetLocked(target, locked);
+    }
+
+
+    /// @dev Returns the instance authorization specification used to set up this instance admin.
+    function getInstanceAuthorization()
+        external
+        view
+        returns (IAuthorization instanceAuthorizaion)
+    {
+        return _authorization;
+    }
+
+    // ------------------- Internal functions ------------------- //
+
+
+    function _createTargetAuthorizations(IAuthorization authorization)
+        internal
+    {
+        Str[] memory targets = authorization.getTargets();
+        Str target;
+
+        for(uint256 i = 0; i < targets.length; i++) {
+            target = targets[i];
+            RoleId[] memory authorizedRoles = authorization.getAuthorizedRoles(target);
+
+            for(uint256 j = 0; j < authorizedRoles.length; j++) {
+                _authorizeFunctions(authorization, target, authorizedRoles[j]);
+            }
+        }
+    }
+}