@etherisc/gif-next 0.0.2-89c8f37-711 → 0.0.2-8a72793-100

package/contracts/authorization/AccessAdmin.sol

@@ -5,13 +5,23 @@ import {AccessManagedUpgradeable} from "@openzeppelin/contracts-upgradeable/acce
 import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
 import {ReentrancyGuardUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/ReentrancyGuardUpgradeable.sol";
 
-import {AccessManagerCloneable} from "./AccessManagerCloneable.sol";
 import {IAccessAdmin} from "./IAccessAdmin.sol";
+import {IAuthorization} from "./IAuthorization.sol";
+import {IRegistry} from "../registry/IRegistry.sol";
+
+import {AccessManagerCloneable} from "./AccessManagerCloneable.sol";
+import {ContractLib} from "../shared/ContractLib.sol";
+import {NftId, NftIdLib} from "../type/NftId.sol";
+import {ObjectType} from "../type/ObjectType.sol";
 import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
 import {Selector, SelectorLib, SelectorSetLib} from "../type/Selector.sol";
 import {Str, StrLib} from "../type/String.sol";
-import {Timestamp, TimestampLib} from "../type/Timestamp.sol";
+import {TimestampLib} from "../type/Timestamp.sol";
+import {VersionPart} from "../type/Version.sol";
 
+interface IAccessManagedChecker {
+    function authority() external view returns (address);
+}
 
 /**
  * @dev A generic access amin contract that implements role based access control based on OpenZeppelin's AccessManager contract.
@@ -28,13 +38,23 @@ contract AccessAdmin is
     string public constant ADMIN_ROLE_NAME = "AdminRole";
     string public constant PUBLIC_ROLE_NAME = "PublicRole";
 
-    /// @dev the OpenZeppelin access manager driving the access admin contract
+    /// @dev admin name used for logging only
+    string internal _adminName;
+
+    /// @dev the access manager driving the access admin contract
+    /// hold link to registry and release version
     AccessManagerCloneable internal _authority;
 
+    /// @dev the authorization contract used for initial access control
+    IAuthorization internal _authorization;
+
     /// @dev stores the deployer address and allows to create initializers
     /// that are restricted to the deployer address.
     address internal _deployer;
 
+    /// @dev the linked NFT ID
+    NftId internal _linkedNftId;
+
     /// @dev store role info per role id
     mapping(RoleId roleId => RoleInfo info) internal _roleInfo;
 
@@ -67,37 +87,42 @@ contract AccessAdmin is
 
     modifier onlyDeployer() {
         // special case for cloned AccessAdmin contracts
-        // IMPORTANT cloning and _initializeAuthority needs to be done in a single transaction
+        // IMPORTANT cloning and initialize authority needs to be done in a single transaction
         if (_deployer == address(0)) {
             _deployer = msg.sender;
         }
 
         if (msg.sender != _deployer) {
-            revert ErrorNotDeployer();
+            revert ErrorAccessAdminNotDeployer();
         }
         _;
     }
 
     modifier onlyRoleAdmin(RoleId roleId) {
-        if (!roleExists(roleId)) {
-            revert ErrorRoleUnknown(roleId);
-        }
+        _checkRoleExists(roleId, false);
 
         if (!hasAdminRole(msg.sender, roleId)) {
-            revert ErrorNotAdminOfRole(_roleInfo[roleId].adminRoleId);
+            revert ErrorAccessAdminNotAdminOfRole(_roleInfo[roleId].adminRoleId);
         }
         _;
     }
 
     modifier onlyRoleMember(RoleId roleId) {
         if (!hasRole(msg.sender, roleId)) {
-            revert ErrorNotRoleOwner(roleId);
+            revert ErrorAccessAdminNotRoleOwner(roleId);
         }
         _;
     }
 
-    modifier onlyExistingRole(RoleId roleId) {
-        _checkRoleId(roleId);
+    modifier onlyExistingRole(
+        RoleId roleId, 
+        bool onlyActiveRole,
+        bool allowLockedRoles
+    )
+    {
+        if (!allowLockedRoles) {
+            _checkRoleExists(roleId, onlyActiveRole);
+        }
         _;
     }
 
@@ -106,14 +131,212 @@ contract AccessAdmin is
         _;
     }
 
-    constructor() {
-        _deployer = msg.sender;
-        _authority = new AccessManagerCloneable();
+    //-------------- initialization functions ------------------------------//
+
+    // event LogAccessAdminDebug(string message);
+
+    /// @dev Initializes this admin with the provided accessManager (and authorization specification).
+    /// Internally initializes access manager with this admin and creates basic role setup.
+    function initialize(
+        address authority,
+        string memory adminName 
+    )
+        public
+        initializer()
+    {
+        __AccessAdmin_init(authority, adminName);
+    }
+
+
+    function __AccessAdmin_init(
+        address authority, 
+        string memory adminName 
+    )
+        internal
+        onlyInitializing()
+        onlyDeployer()
+    {
+        // checks
+        // check authority is contract
+        if (!ContractLib.isContract(authority)) {
+            revert ErrorAccessAdminAuthorityNotContract(authority);
+        }
+
+        // check name not empty
+        if (bytes(adminName).length == 0) {
+            revert ErrorAccessAdminAccessManagerEmptyName();
+        }
+
+        _authority = AccessManagerCloneable(authority);
         _authority.initialize(address(this));
 
-        _setAuthority(address(_authority)); // set authority for oz access managed
-        _createAdminAndPublicRoles();
-        _disableInitializers();
+        // delayed additional check for authority after its initialization
+        if (!ContractLib.isAuthority(authority)) {
+            revert ErrorAccessAdminAccessManagerNotAccessManager(authority);
+        }
+
+        // effects
+        // set and initialize this access manager contract as
+        // the admin (ADMIN_ROLE) of the provided authority
+        __AccessManaged_init(authority);
+
+        // set name for logging
+        _adminName = adminName;
+
+        // set initial linked NFT ID to zero
+        _linkedNftId = NftIdLib.zero();
+
+        // create admin and public roles
+        _initializeAdminAndPublicRoles();
+    }
+
+
+    /// @dev check if target exists and reverts if it doesn't
+    function _checkTarget(
+        address target
+    )
+        internal
+        view
+    {
+        // check not yet created
+        if (!targetExists(target)) {
+            revert ErrorAccessAdminTargetNotCreated(target);
+        }
+    }
+
+    function _checkIsRegistered(
+        address registry,
+        address target,
+        ObjectType expectedType
+    )
+        internal
+        view 
+    {
+        ObjectType tagetType = IRegistry(registry).getObjectInfo(target).objectType;
+        if (tagetType.eqz()) {
+            revert ErrorAccessAdminNotRegistered(target);
+        }
+
+        if (tagetType != expectedType) {
+            revert ErrorAccessAdminTargetTypeMismatch(target, expectedType, tagetType);
+        }
+    }
+
+    /// @dev check if target exists and and has expected type, reverts if it doesn't
+    function _checkTargetWithType(
+        address target,
+        ObjectType expectedType
+    )
+        internal
+        view
+    {
+        // check target exists
+        _checkTarget(target);
+
+        // check target type 
+        ObjectType tagetType = _authority.getRegistry().getObjectInfo(target).objectType;
+        if (tagetType != expectedType) {
+            revert ErrorAccessAdminTargetTypeMismatch(target, expectedType, tagetType);
+        }
+
+        // target release is checked during component/instance registration
+    }
+
+
+    function _checkAuthorization(
+        address authorization,
+        ObjectType expectedDomain, 
+        VersionPart expectedRelease,
+        bool checkAlreadyInitialized
+    )
+        internal
+        view
+    {
+        // checks
+        // check not yet initialized
+        if (checkAlreadyInitialized && address(_authorization) != address(0)) {
+            revert ErrorAccessAdminAlreadyInitialized(address(_authorization));
+        }
+
+        // check contract type matches
+        if (!ContractLib.supportsInterface(authorization, type(IAuthorization).interfaceId)) {  
+            revert ErrorAccessAdminNotAuthorization(authorization);
+        }
+
+        // check domain matches
+        ObjectType domain = IAuthorization(authorization).getDomain();
+        if (domain != expectedDomain) {
+            revert ErrorAccessAdminDomainMismatch(authorization, expectedDomain, domain);
+        }
+
+        // check release matches
+        VersionPart authorizationRelease = IAuthorization(authorization).getRelease();
+        if (authorizationRelease != expectedRelease) {
+            revert ErrorAccessAdminReleaseMismatch(authorization, getRelease(), authorizationRelease);
+        }
+    }
+
+
+    function getRelease() public view virtual returns (VersionPart release) {
+        return _authority.getRelease();
+    }
+
+
+    function getRegistry() public view returns (IRegistry registry) {
+        return _authority.getRegistry();
+    }
+
+
+    function getLinkedNftId() external view returns (NftId linkedNftId) {
+        return _linkedNftId;
+    }
+
+
+    function getLinkedOwner() external view returns (address linkedOwner) {
+        return getRegistry().ownerOf(_linkedNftId);
+    }
+
+
+
+    function isLocked() public view returns (bool locked) {
+        return _authority.isLocked();
+    }
+
+    function _linkToNftOwnable(address registerable) internal {
+        if (!getRegistry().isRegistered(registerable)) {
+            revert ErrorAccessAdminNotRegistered(registerable);
+        }
+
+        _linkedNftId = getRegistry().getNftIdForAddress(registerable);
+    }
+
+    function _initializeAdminAndPublicRoles()
+        internal
+        virtual
+        onlyInitializing()
+    {
+        RoleId adminRoleId = RoleIdLib.toRoleId(_authority.ADMIN_ROLE());
+
+        // setup admin role
+        _createRoleUnchecked(
+            ADMIN_ROLE(),
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: 1,
+                name: ADMIN_ROLE_NAME}));
+
+        // add this contract as admin role member
+        _roleMembers[adminRoleId].add(address(this));
+
+        // setup public role
+        _createRoleUnchecked(
+            PUBLIC_ROLE(),
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Gif,
+                maxMemberCount: type(uint32).max,
+                name: PUBLIC_ROLE_NAME}));
     }
 
     //--- view functions for roles ------------------------------------------//
@@ -154,6 +377,7 @@ contract AccessAdmin is
         return _roleMembers[roleId].at(idx);
     }
 
+    // TODO false because not role member or because role not exists?
     function hasRole(address account, RoleId roleId) public view returns (bool) {
         (bool isMember, ) = _authority.hasRole(
             RoleId.unwrap(roleId), 
@@ -219,18 +443,6 @@ contract AccessAdmin is
                 selector.toBytes4()));
     }
 
-    function isAccessManaged(address target) public view returns (bool) {
-        if (!_isContract(target)) {
-            return false;
-        }
-
-        (bool success, ) = target.staticcall(
-            abi.encodeWithSelector(
-                AccessManagedUpgradeable.authority.selector));
-
-        return success;
-    }
-
     function canCall(address caller, address target, Selector selector) external virtual view returns (bool can) {
         (can, ) = _authority.canCall(caller, target, selector.toBytes4());
     }
@@ -241,7 +453,8 @@ contract AccessAdmin is
             adminRoleId: adminRoleId,
             roleType: roleType,
             maxMemberCount: maxMemberCount,
-            createdAt: TimestampLib.blockTimestamp()
+            createdAt: TimestampLib.blockTimestamp(),
+            pausedAt: TimestampLib.max()
         });
     }
 
@@ -258,6 +471,17 @@ contract AccessAdmin is
 
     //--- internal/private functions -------------------------------------------------//
 
+    function _createTargetWithRole(
+        address target,
+        string memory targetName,
+        RoleId targetRoleId
+    )
+        internal
+    {
+        _createTarget(target, targetName, true, false);
+        _grantRoleToAccount(targetRoleId, target);
+    }
+
     function _authorizeTargetFunctions(
         address target, 
         RoleId roleId, 
@@ -266,14 +490,21 @@ contract AccessAdmin is
         internal
     {
         if (roleId == getAdminRole()) {
-            revert ErrorAuthorizeForAdminRoleInvalid(target);
+            revert ErrorAccessAdminAuthorizeForAdminRoleInvalid(target);
         }
 
-        bool addFunctions = true;
-        bytes4[] memory functionSelectors = _processFunctionSelectors(target, functions, addFunctions);
+        (
+            bytes4[] memory functionSelectors,
+            string[] memory functionNames
+        ) = _processFunctionSelectors(target, functions, true);
 
         // apply authz via access manager
-        _grantRoleAccessToFunctions(target, roleId, functionSelectors);
+        _grantRoleAccessToFunctions(
+            target, 
+            roleId, 
+            functionSelectors,
+            functionNames, 
+            false); // allow locked roles
     }
 
     function _unauthorizeTargetFunctions(
@@ -282,9 +513,17 @@ contract AccessAdmin is
     )
         internal
     {
-        bool addFunctions = false;
-        bytes4[] memory functionSelectors = _processFunctionSelectors(target, functions, addFunctions);
-        _grantRoleAccessToFunctions(target, getAdminRole(), functionSelectors);
+        (
+            bytes4[] memory functionSelectors,
+            string[] memory functionNames
+        ) = _processFunctionSelectors(target, functions, false);
+
+        _grantRoleAccessToFunctions(
+            target, 
+            getAdminRole(), 
+            functionSelectors, 
+            functionNames, 
+            true);  // allowLockedRoles
     }
 
     function _processFunctionSelectors(
@@ -293,12 +532,15 @@ contract AccessAdmin is
         bool addFunctions
     )
         internal
+        onlyExistingTarget(target)
         returns (
-            bytes4[] memory functionSelectors
+            bytes4[] memory functionSelectors,
+            string[] memory functionNames
         )
     {
         uint256 n = functions.length;
         functionSelectors = new bytes4[](n);
+        functionNames = new string[](n);
         FunctionInfo memory func;
         Selector selector;
 
@@ -315,70 +557,7 @@ contract AccessAdmin is
 
             // add bytes4 selector to function selector array
             functionSelectors[i] = selector.toBytes4();
-        }
-    }
-
-    function _initializeAuthority(
-        address authorityAddress
-    )
-        internal
-        virtual
-        onlyInitializing()
-        onlyDeployer()
-    {
-        if (authority() != address(0)) {
-            revert ErrorAuthorityAlreadySet();
-        }
-
-        _authority = AccessManagerCloneable(authorityAddress);
-        __AccessManaged_init(address(_authority));
-    }
-
-
-    function _initializeAdminAndPublicRoles()
-        internal
-        virtual
-        onlyInitializing()
-    {
-        _createAdminAndPublicRoles();
-    }
-
-
-    /// @dev internal setup function that can be used in both constructor and initializer.
-    function _createAdminAndPublicRoles()
-        internal
-    {
-        RoleId adminRoleId = RoleIdLib.toRoleId(_authority.ADMIN_ROLE());
-        FunctionInfo[] memory functions;
-
-        // setup admin role
-        _createRoleUnchecked(
-            ADMIN_ROLE(),
-            toRole({
-                adminRoleId: ADMIN_ROLE(),
-                roleType: RoleType.Contract,
-                maxMemberCount: 1,
-                name: ADMIN_ROLE_NAME}));
-
-        // add this contract as admin role member
-        _roleMembers[adminRoleId].add(address(this));
-
-        // setup public role
-        _createRoleUnchecked(
-            PUBLIC_ROLE(),
-            toRole({
-                adminRoleId: ADMIN_ROLE(),
-                roleType: RoleType.Gif,
-                maxMemberCount: type(uint32).max,
-                name: PUBLIC_ROLE_NAME}));
-    }
-
-    /// @dev check if target exists and reverts if it doesn't
-    function _checkTarget(address target)
-        internal
-    {
-        if (_targetInfo[target].createdAt.eqz()) {
-            revert ErrorTargetUnknown(target);
+            functionNames[i] = func.name.toString();
         }
     }
 
@@ -386,78 +565,82 @@ contract AccessAdmin is
     function _grantRoleAccessToFunctions(
         address target,
         RoleId roleId, 
-        bytes4[] memory functionSelectors
+        bytes4[] memory functionSelectors,
+        string[] memory functionNames,
+        bool allowLockedRoles // admin and public roles are locked
     )
         internal
+        onlyExistingTarget(target)
+        onlyExistingRole(roleId, true, allowLockedRoles)
     {
+
         _authority.setTargetFunctionRole(
             target,
             functionSelectors,
             RoleId.unwrap(roleId));
 
-        // implizit logging: rely on OpenZeppelin log TargetFunctionRoleUpdated
+        // log function grantings
+        for (uint256 i = 0; i < functionSelectors.length; i++) {
+            emit LogAccessAdminFunctionGranted(
+                _adminName, 
+                target, 
+                string(abi.encodePacked(
+                    functionNames[i], 
+                    "(): ",
+                    _getRoleName(roleId))));
+        }
     }
 
+
     /// @dev grant the specified role to the provided account
     function _grantRoleToAccount(RoleId roleId, address account)
         internal
+        onlyExistingRole(roleId, true, false)
     {
-        _checkRoleId(roleId);
-
         // check max role members will not be exceeded
         if (_roleMembers[roleId].length() >= _roleInfo[roleId].maxMemberCount) {
-            revert ErrorRoleMembersLimitReached(roleId, _roleInfo[roleId].maxMemberCount);
+            revert ErrorAccessAdminRoleMembersLimitReached(roleId, _roleInfo[roleId].maxMemberCount);
         }
 
         // check account is contract for contract role
-        // TODO implement
-        if (_roleInfo[roleId].roleType == RoleType.Contract) {
+        if (
+            _roleInfo[roleId].roleType == RoleType.Contract &&
+            !ContractLib.isContract(account) // will fail in account's constructor
+        ) {
+            revert ErrorAccessAdminRoleMemberNotContract(roleId, account);
         }
 
+        // TODO check account already have roleId
         _roleMembers[roleId].add(account);
         _authority.grantRole(
             RoleId.unwrap(roleId), 
             account, 
             0);
         
-        // indirect logging: rely on OpenZeppelin log RoleGranted
+        emit LogAccessAdminRoleGranted(_adminName, account, _getRoleName(roleId));
     }
 
     /// @dev revoke the specified role from the provided account
     function _revokeRoleFromAccount(RoleId roleId, address account)
         internal
+        onlyExistingRole(roleId, false, false)
     {
-        _checkRoleId(roleId);
 
         // check role removal is permitted
         if (_roleInfo[roleId].roleType == RoleType.Contract) {
-            revert ErrorRoleRemovalDisabled(roleId);
+            revert ErrorAccessAdminRoleMemberRemovalDisabled(roleId, account);
         }
 
+        // TODO check account have roleId?
         _roleMembers[roleId].remove(account);
         _authority.revokeRole(
             RoleId.unwrap(roleId), 
             account);
 
-        // indirect logging: rely on OpenZeppelin log RoleGranted
+        emit LogAccessAdminRoleRevoked(_adminName, account, _roleInfo[roleId].name.toString());
     }
 
 
-    function _checkRoleId(RoleId roleId)
-        internal
-    {
-        if (_roleInfo[roleId].createdAt.eqz()) {
-            revert ErrorRoleUnknown(roleId);
-        }
-
-        uint64 roleIdInt = RoleId.unwrap(roleId);
-        if (roleIdInt == _authority.ADMIN_ROLE()
-            || roleIdInt == _authority.PUBLIC_ROLE())
-        {
-            revert ErrorRoleIsLocked(roleId);
-        }
-    }
-
     /// @dev Creates a role based on the provided parameters.
     /// Checks that the provided role and role id and role name not already used.
     function _createRole(
@@ -468,24 +651,24 @@ contract AccessAdmin is
     {
         // check role does not yet exist
         if(roleExists(roleId)) {
-            revert ErrorRoleAlreadyCreated(
+            revert ErrorAccessAdminRoleAlreadyCreated(
                 roleId, 
                 _roleInfo[roleId].name.toString());
         }
 
         // check admin role exists
         if(!roleExists(info.adminRoleId)) {
-            revert ErrorRoleAdminNotExisting(info.adminRoleId);
+            revert ErrorAccessAdminRoleAdminNotExisting(info.adminRoleId);
         }
 
         // check role name is not empty
         if(info.name.length() == 0) {
-            revert ErrorRoleNameEmpty(roleId);
+            revert ErrorAccessAdminRoleNameEmpty(roleId);
         }
 
         // check role name is not used for another role
         if(_roleForName[info.name].exists) {
-            revert ErrorRoleNameAlreadyExists(
+            revert ErrorAccessAdminRoleNameAlreadyExists(
                 roleId, 
                 info.name.toString(),
                 _roleForName[info.name].roleId);
@@ -513,7 +696,7 @@ contract AccessAdmin is
         // add role to list of roles
         _roleIds.push(roleId);
 
-        emit LogRoleCreated(roleId, info.roleType, info.adminRoleId, info.name.toString());
+        emit LogAccessAdminRoleCreated(_adminName, roleId, info.roleType, info.adminRoleId, info.name.toString());
     }
 
 
@@ -524,11 +707,10 @@ contract AccessAdmin is
         bool custom
     )
         internal
-        nonReentrant()
     {
         // check target does not yet exist
         if(targetExists(target)) {
-            revert ErrorTargetAlreadyCreated(
+            revert ErrorAccessAdminTargetAlreadyCreated(
                 target, 
                 _targetInfo[target].name.toString());
         }
@@ -536,27 +718,27 @@ contract AccessAdmin is
         // check target name is not empty
         Str name = StrLib.toStr(targetName);
         if(name.length() == 0) {
-            revert ErrorTargetNameEmpty(target);
+            revert ErrorAccessAdminTargetNameEmpty(target);
         }
 
         // check target name is not used for another target
         if( _targetForName[name] != address(0)) {
-            revert ErrorTargetNameAlreadyExists(
+            revert ErrorAccessAdminTargetNameAlreadyExists(
                 target, 
                 targetName,
                 _targetForName[name]);
         }
 
         // check target is an access managed contract
-        if (!isAccessManaged(target)) {
-            revert ErrorTargetNotAccessManaged(target);
+        if (!_isAccessManaged(target)) {
+            revert ErrorAccessAdminTargetNotAccessManaged(target);
         }
 
         // check target shares authority with this contract
         if (checkAuthority) {
             address targetAuthority = AccessManagedUpgradeable(target).authority();
             if (targetAuthority != authority()) {
-                revert ErrorTargetAuthorityMismatch(authority(), targetAuthority);
+                revert ErrorAccessAdminTargetAuthorityMismatch(authority(), targetAuthority);
             }
         }
 
@@ -573,19 +755,77 @@ contract AccessAdmin is
         // add role to list of roles
         _targets.push(target);
 
-        emit LogTargetCreated(target, targetName);
+        emit LogAccessAdminTargetCreated(_adminName, target, targetName);
     }
 
-    function _isContract(address target)
+
+    function _setTargetLocked(address target, bool locked)
         internal
-        view 
+        onlyExistingTarget(target)
+    {
+        _authority.setTargetClosed(target, locked);
+    }
+
+
+    function _isAccessManaged(address target)
+        internal
+        view
         returns (bool)
     {
-        uint256 size;
-        assembly {
-            size := extcodesize(target)
+        if (!ContractLib.isContract(target)) {
+            return false;
+        }
+
+        (bool success, ) = target.staticcall(
+            abi.encodeWithSelector(
+                IAccessManagedChecker.authority.selector));
+
+        return success;
+    }
+
+
+    function _getAccountName(address account) internal view returns (string memory) {
+        if (targetExists(account)) {
+            return _targetInfo[account].name.toString();
+        }
+        return "<unknown-account>";
+    }
+
+
+    function _getRoleName(RoleId roleId) internal view returns (string memory) {
+        if (roleExists(roleId)) {
+            return _roleInfo[roleId].name.toString();
+        }
+        return "<unknown-role>";
+    }
+
+
+    function _checkRoleExists(
+        RoleId roleId, 
+        bool onlyActiveRole
+    )
+        internal
+        view
+    {
+        if (!roleExists(roleId)) {
+            revert ErrorAccessAdminRoleUnknown(roleId);
+        }
+
+        uint64 roleIdInt = RoleId.unwrap(roleId);
+        if (roleIdInt == _authority.ADMIN_ROLE()) {
+            revert ErrorAccessAdminRoleIsLocked(roleId);
+        }
+
+        // check if role is disabled
+        if (onlyActiveRole && _roleInfo[roleId].pausedAt <= TimestampLib.blockTimestamp()) {
+            revert ErrorAccessAdminRoleIsPaused(roleId);
+        }
+    }
+
+
+    function _checkRegistry(address registry) internal view {
+        if (!ContractLib.isRegistry(registry)) {
+            revert ErrorAccessAdminNotRegistry(registry);
         }
-        return size > 0;
     }
-    
 }