@etherisc/gif-next 0.0.2-8bdd2eb-413 → 0.0.2-8d9d4d6-542

package/contracts/instance/IInstanceService.sol

@@ -1,19 +1,24 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {Amount} from "../type/Amount.sol";
+import {BundleManager} from "./BundleManager.sol";
+import {Instance} from "./Instance.sol";
+import {IService} from "../shared/IService.sol";
 import {NftId} from "../type/NftId.sol";
 import {ObjectType} from "../type/ObjectType.sol";
 import {RoleId} from "../type/RoleId.sol";
-import {IService} from "../shared/IService.sol";
-
-import {InstanceAdmin} from "./InstanceAdmin.sol";
-import {Instance} from "./Instance.sol";
-import {InstanceReader} from "./InstanceReader.sol";
-import {BundleManager} from "./BundleManager.sol";
-import {InstanceStore} from "./InstanceStore.sol";
+import {Seconds} from "../type/Seconds.sol";
+import {UFixed} from "../type/UFixed.sol";
+import {VersionPart} from "../type/Version.sol";
 
 interface IInstanceService is IService {
 
+    // onlyInstance
+    error ErrorInstanceServiceNotRegistered(address instance);
+    error ErrorInstanceServiceNotInstance(address instance, ObjectType objectType);
+    error ErrorInstanceServiceInstanceVersionMismatch(address instance, VersionPart instanceVersion);
+
     error ErrorInstanceServiceComponentNotInstanceLinked(address component);
 
     error ErrorInstanceServiceMasterInstanceAlreadySet();
@@ -39,7 +44,7 @@ interface IInstanceService is IService {
     error ErrorInstanceServiceInstanceStoreAuthorityMismatch();
 
     error ErrorInstanceServiceRequestUnauhorized(address caller);
-    error ErrorInstanceServiceNotInstance(NftId nftId);
+    error ErrorInstanceServiceNotInstanceNftId(NftId nftId);
     error ErrorInstanceServiceComponentNotRegistered(address componentAddress);
     error ErrorInstanceServiceInstanceComponentMismatch(NftId instanceNftId, NftId componentNftId);
     error ErrorInstanceServiceInvalidComponentType(address componentAddress, ObjectType expectedType, ObjectType componentType);
@@ -57,10 +62,21 @@ interface IInstanceService is IService {
     function createInstanceClone()
         external 
         returns (
+            // TODO check if Instance can be changed to IInstance
             Instance clonedInstance,
             NftId instanceNftId
         );
 
+
+    function setStakingLockingPeriod(Seconds stakeLockingPeriod) external;
+    function setStakingRewardRate(UFixed rewardRate) external;
+    function refillStakingRewardReserves(address rewardProvider, Amount dipAmount) external;
+
+    /// @dev defunds the staking reward reserves for the specified target
+    /// permissioned: only the target owner may call this function
+    function withdrawStakingRewardReserves(Amount dipAmount) external returns (Amount newBalance);
+
+
     function createComponentTarget(
         NftId instanceNftId,
         address targetAddress,

package/contracts/instance/Instance.sol

@@ -3,16 +3,19 @@ pragma solidity ^0.8.20;
 
 import {AccessManagedUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagedUpgradeable.sol";
 
+import {Amount} from "../type/Amount.sol";
 import {Key32} from "../type/Key32.sol";
 import {NftId} from "../type/NftId.sol";
 import {RiskId} from "../type/RiskId.sol";
 import {ObjectType, BUNDLE, DISTRIBUTION, INSTANCE, POLICY, POOL, ROLE, PRODUCT, TARGET, COMPONENT, DISTRIBUTOR, DISTRIBUTOR_TYPE} from "../type/ObjectType.sol";
 import {RoleId, RoleIdLib, eqRoleId, ADMIN_ROLE, INSTANCE_ROLE, INSTANCE_OWNER_ROLE} from "../type/RoleId.sol";
-import {VersionPart, VersionPartLib} from "../type/Version.sol";
 import {ClaimId} from "../type/ClaimId.sol";
 import {ReferralId} from "../type/Referral.sol";
 import {PayoutId} from "../type/PayoutId.sol";
 import {DistributorType} from "../type/DistributorType.sol";
+import {Seconds} from "../type/Seconds.sol";
+import {UFixed} from "../type/UFixed.sol";
+import {VersionPart, VersionPartLib} from "../type/Version.sol";
 
 import {Registerable} from "../shared/Registerable.sol";
 import {TokenHandler} from "../shared/TokenHandler.sol";
@@ -21,6 +24,7 @@ import {AccessManagerExtendedInitializeable} from "../shared/AccessManagerExtend
 import {IRegistry} from "../registry/IRegistry.sol";
 
 import {IInstance} from "./IInstance.sol";
+import {IInstanceService} from "./IInstanceService.sol";
 import {InstanceReader} from "./InstanceReader.sol";
 import {InstanceAdmin} from "./InstanceAdmin.sol";
 import {BundleManager} from "./BundleManager.sol";
@@ -49,6 +53,7 @@ contract Instance is
 
     bool private _initialized;
 
+    IInstanceService internal _instanceService;
     InstanceAdmin internal _instanceAdmin;
     InstanceReader internal _instanceReader;
     BundleManager internal _bundleManager;
@@ -74,14 +79,52 @@ contract Instance is
         IRegistry registry = IRegistry(registryAddress);
         initializeRegisterable(registryAddress, registry.getNftId(), INSTANCE(), true, initialOwner, "");
 
+        _instanceService = IInstanceService(
+            getRegistry().getServiceAddress(
+                INSTANCE(), 
+                getMajorVersion()));
+
         registerInterface(type(IInstance).interfaceId);    
     }
 
+    //--- Staking ----------------------------------------------------------//
+
+    function setStakingLockingPeriod(Seconds stakeLockingPeriod)
+        external
+        // TODO decide if onlyOwner or restricted to instance owner role is better
+        onlyOwner()
+    {
+        _instanceService.setStakingLockingPeriod(stakeLockingPeriod);
+    }
+
+    function setStakingRewardRate(UFixed rewardRate)
+        external
+        onlyOwner()
+    {
+        _instanceService.setStakingRewardRate(rewardRate);
+    }
+
+    function refillStakingRewardReserves(Amount dipAmount)
+        external
+        onlyOwner()
+    {
+        address instanceOwner = msg.sender;
+        _instanceService.refillStakingRewardReserves(instanceOwner, dipAmount);
+    }
+
+    function withdrawStakingRewardReserves(Amount dipAmount)
+        external
+        onlyOwner()
+        returns (Amount newBalance)
+    {
+        return _instanceService.withdrawStakingRewardReserves(dipAmount);
+    }
+
     //--- Roles ------------------------------------------------------------//
 
     function createRole(string memory roleName, string memory adminName)
         external
-        restricted // INSTANCE_OWNER_ROLE
+        onlyOwner()
         returns (RoleId roleId, RoleId admin)
     {
         (roleId, admin) = _instanceAdmin.createRole(roleName, adminName);
@@ -89,14 +132,14 @@ contract Instance is
 
     function grantRole(RoleId roleId, address account) 
         external 
-        restricted // INSTANCE_OWNER_ROLE
+        onlyOwner()
     {
         AccessManagerExtendedInitializeable(authority()).grantRole(roleId.toInt(), account, 0);
     }
 
     function revokeRole(RoleId roleId, address account) 
         external 
-        restricted // INSTANCE_OWNER_ROLE
+        onlyOwner()
     {
         AccessManagerExtendedInitializeable(authority()).revokeRole(roleId.toInt(), account);
     }
@@ -105,7 +148,7 @@ contract Instance is
 
     function createTarget(address target, string memory name) 
         external 
-        restricted // INSTANCE_OWNER_ROLE
+        onlyOwner()
     {
         _instanceAdmin.createTarget(target, name);
     }
@@ -116,19 +159,20 @@ contract Instance is
         RoleId roleId
     ) 
         external 
-        restricted // INSTANCE_OWNER_ROLE
+        onlyOwner()
     {
         _instanceAdmin.setTargetFunctionRoleByInstance(targetName, selectors, roleId);
     }
 
     function setTargetLocked(address target, bool locked)
         external 
-        restricted // INSTANCE_OWNER_ROLE
+        onlyOwner()
     {
         _instanceAdmin.setTargetLockedByInstance(target, locked);
     }
 
-    //--- ITransferInterceptor ------------------------------------------------------------//
+    //--- ITransferInterceptor ----------------------------------------------//
+
     // TODO interception of child components nfts
     function nftMint(address to, uint256 tokenId) external onlyChainNft {
         _instanceAdmin.transferInstanceOwnerRole(address(0), to);
@@ -167,6 +211,16 @@ contract Instance is
         _bundleManager = bundleManager;
     }
 
+    function setInstanceStore(InstanceStore instanceStore) external restricted {
+        if(address(_instanceStore) != address(0)) {
+            revert ErrorInstanceInstanceStoreAlreadySet(address(_instanceStore));
+        }
+        if(instanceStore.authority() != authority()) {
+            revert ErrorInstanceInstanceStoreAuthorityMismatch(authority());
+        }
+        _instanceStore = instanceStore;
+    }
+
     function setInstanceReader(InstanceReader instanceReader) external restricted() {
         if(instanceReader.getInstance() != Instance(this)) {
             revert ErrorInstanceInstanceReaderInstanceMismatch(address(this));
@@ -193,43 +247,13 @@ contract Instance is
         return AccessManagerExtendedInitializeable(authority());
     }
 
-    function setInstanceStore(InstanceStore instanceStore) external restricted {
-        if(address(_instanceStore) != address(0)) {
-            revert ErrorInstanceInstanceStoreAlreadySet(address(_instanceStore));
-        }
-        if(instanceStore.authority() != authority()) {
-            revert ErrorInstanceInstanceStoreAuthorityMismatch(authority());
-        }
-        _instanceStore = instanceStore;
-    }
-
     function getInstanceStore() external view returns (InstanceStore) {
         return _instanceStore;
     }
 
-    function getMajorVersion() external pure returns (VersionPart majorVersion) {
+    function getMajorVersion() public pure returns (VersionPart majorVersion) {
         return VersionPartLib.toVersionPart(GIF_MAJOR_VERSION);
     }
 
-    function getDistributionService() external view returns (IDistributionService) {
-        return IDistributionService(getRegistry().getServiceAddress(DISTRIBUTION(), VersionPart.wrap(3)));
-    }
-
-    function getProductService() external view returns (IProductService) {
-        return IProductService(getRegistry().getServiceAddress(PRODUCT(), VersionPart.wrap(3)));
-    }
-
-    function getPoolService() external view returns (IPoolService) {
-        return IPoolService(getRegistry().getServiceAddress(POOL(), VersionPart.wrap(3)));
-    }
-
-    function getPolicyService() external view returns (IPolicyService) {
-        return IPolicyService(getRegistry().getServiceAddress(POLICY(), VersionPart.wrap(3)));
-    }
-
-    function getBundleService() external view returns (IBundleService) {
-        return IBundleService(getRegistry().getServiceAddress(BUNDLE(), VersionPart.wrap(3)));
-    }
-
     //--- internal view/pure functions --------------------------------------//
 }

package/contracts/instance/InstanceAdminNew.sol

@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import {AccessAdmin} from "../authorization/AccessAdmin.sol";
+import {IAccessAdmin} from "../authorization/IAccessAdmin.sol";
+import {IRegistry} from "../registry/IRegistry.sol";
+import {IInstance} from "./IInstance.sol";
+import {IService} from "../shared/IService.sol";
+import {ObjectType, ObjectTypeLib, ALL, POOL, RELEASE} from "../type/ObjectType.sol";
+import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE, INSTANCE_ROLE} from "../type/RoleId.sol";
+import {VersionPart} from "../type/Version.sol";
+
+
+contract InstanceAdminNew is
+    AccessAdmin
+{
+    string public constant INSTANCE_ROLE_NAME = "InstanceRole";
+    string public constant INSTANCE_OWNER_ROLE_NAME = "InstanceOwnerRole";
+
+    string public constant INSTANCE_ADMIN_TARGET_NAME = "InstanceAdmin";
+    string public constant INSTANCE_STORE_TARGET_NAME = "InstanceStore";
+    string public constant INSTANCE_TARGET_NAME = "Instance";
+
+    uint64 public constant CUSTOM_ROLE_ID_MIN = 10000; // MUST be even
+
+    address _instance;
+    IRegistry internal _registry;
+    uint64 _idNext;
+
+    bool private _setupCompleted;
+
+
+    // instance owner role is granted upon instance nft minting in callback function
+    function initialize(address instanceAddress)
+        external
+        initializer() 
+    {
+        _instance = instanceAddress;
+        IInstance instance = IInstance(instanceAddress);
+
+        _initializeAuthority(
+            instance.authority());
+
+        _registry = instance.getRegistry();
+        _idNext = CUSTOM_ROLE_ID_MIN;
+
+        _createInitialRoleSetup();
+        _setupInstanceAdmin();
+        _setupInstance();
+    }
+
+
+    function _setupInstanceAdmin()
+        internal
+    {
+        // _createTarget(address(this), INSTANCE_ADMIN_TARGET_NAME, IAccess.Type.Core);
+    }
+
+
+    function _setupInstance()
+        internal
+    {
+        // _createTarget(_instance, INSTANCE_TARGET_NAME, IAccess.Type.Core);
+
+        // minimum configuration required for nft interception
+        // _createRole(INSTANCE_ROLE(), INSTANCE_ROLE_NAME, IAccess.Type.Core);
+        // _createRole(INSTANCE_OWNER_ROLE(), INSTANCE_OWNER_ROLE_NAME, IAccess.Type.Core);
+        // _grantRole(INSTANCE_ROLE(), _instance);
+
+        // bytes4[] memory instanceAdminInstanceSelectors = new bytes4[](1);
+        // instanceAdminInstanceSelectors[0] = this.transferInstanceOwnerRole.selector;
+        // _setTargetFunctionRole(address(this), instanceAdminInstanceSelectors, INSTANCE_ROLE());                
+    }
+}

package/contracts/instance/InstanceAuthorizationV3.sol

@@ -0,0 +1,176 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {
+     ALL, REGISTRY, SERVICE, PRODUCT, ORACLE, POOL, INSTANCE, COMPONENT, DISTRIBUTION, DISTRIBUTOR, APPLICATION, POLICY, CLAIM, BUNDLE, STAKE, STAKING, PRICE
+} from "../../contracts/type/ObjectType.sol";
+
+import {IAccess} from "../authorization/IAccess.sol";
+import {Instance} from "../instance/Instance.sol";
+import {InstanceAdmin} from "../instance/InstanceAdmin.sol";
+import {InstanceStore} from "../instance/InstanceStore.sol";
+import {ModuleAuthorization} from "../authorization/ModuleAuthorization.sol";
+import {VersionPart, VersionPartLib} from "../type/Version.sol";
+
+
+contract InstanceAuthorizationV3
+     is ModuleAuthorization
+{
+     uint256 public constant GIF_VERSION = 3;
+
+     string public constant INSTANCE_TARGET_NAME = "Instance";
+     string public constant INSTANCE_STORE_TARGET_NAME = "InstanceStore";
+     string public constant INSTANCE_ADMIN_TARGET_NAME = "InstanceAdmin";
+     string public constant BUNDLE_MANAGER_TARGET_NAME = "BundleManager";
+
+     string public constant INSTANCE_ROLE_NAME = "InstanceRole";
+
+     function getRelease() public override view returns(VersionPart release) {
+          return VersionPartLib.toVersionPart(GIF_VERSION);
+     }
+
+     function _setupTargets()
+          internal
+          override
+     {
+          _addTarget(INSTANCE_TARGET_NAME);
+          _addTarget(INSTANCE_STORE_TARGET_NAME);
+          _addTarget(INSTANCE_ADMIN_TARGET_NAME);
+          _addTarget(BUNDLE_MANAGER_TARGET_NAME);
+     }
+
+     function _setupRoles()
+          internal
+          override
+     {
+          _addRole(_getTargetRoleId(INSTANCE()), INSTANCE_ROLE_NAME);
+
+          _addServiceRole(INSTANCE());
+          _addServiceRole(COMPONENT());
+          _addServiceRole(DISTRIBUTION());
+          _addServiceRole(ORACLE());
+          _addServiceRole(POOL());
+          _addServiceRole(BUNDLE());
+          _addServiceRole(PRODUCT());
+          _addServiceRole(APPLICATION());
+          _addServiceRole(POLICY());
+          _addServiceRole(CLAIM());
+     }
+
+
+     function _setupTargetAuthorizations()
+          internal
+          override
+     {
+          _setupInstanceAuthorization();
+          _setupInstanceAdminAuthorization();
+          _setupInstanceStoreAuthorization();
+     }
+
+
+     function _setupInstanceAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          // authorize instance service role
+          functions = _authorizeForTarget( INSTANCE_TARGET_NAME, _getServiceRoleId(INSTANCE()));
+          _authorize(functions, Instance.setInstanceAdmin.selector, "setInstanceAdmin");
+          _authorize(functions, Instance.setInstanceStore.selector, "setInstanceStore");
+          _authorize(functions, Instance.setBundleManager.selector, "setBundleManager");
+          _authorize(functions, Instance.setInstanceReader.selector, "setInstanceReader");
+     }
+
+
+     function _setupInstanceAdminAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          // authorize instance role
+          functions = _authorizeForTarget(INSTANCE_ADMIN_TARGET_NAME, _getTargetRoleId(INSTANCE()));
+          _authorize(functions, InstanceAdmin.createRole.selector, "createRole");
+          _authorize(functions, InstanceAdmin.createTarget.selector, "createTarget");
+          _authorize(functions, InstanceAdmin.setTargetFunctionRoleByInstance.selector, "setTargetFunctionRoleByInstance");
+          _authorize(functions, InstanceAdmin.setTargetLockedByInstance.selector, "setTargetLockedByInstance");
+
+          // authorize instance service role
+          functions = _authorizeForTarget(INSTANCE_ADMIN_TARGET_NAME, _getServiceRoleId(INSTANCE()));
+          _authorize(functions, InstanceAdmin.createGifTarget.selector, "createGifTarget");
+          _authorize(functions, InstanceAdmin.setTargetLockedByService.selector, "setTargetLockedByService");
+          _authorize(functions, InstanceAdmin.setTargetFunctionRoleByService.selector, "setTargetFunctionRoleByService");
+     }
+
+
+     function _setupInstanceStoreAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          // authorize component service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, _getServiceRoleId(COMPONENT()));
+          _authorize(functions, InstanceStore.createComponent.selector, "createComponent");
+          _authorize(functions, InstanceStore.updateComponent.selector, "updateComponent");
+          _authorize(functions, InstanceStore.createPool.selector, "createPool");
+          _authorize(functions, InstanceStore.createProduct.selector, "createProduct");
+          _authorize(functions, InstanceStore.updateProduct.selector, "updateProduct");
+          _authorize(functions, InstanceStore.increaseBalance.selector, "increaseBalance");
+          _authorize(functions, InstanceStore.increaseFees.selector, "increaseFees");
+
+          // authorize distribution service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, _getServiceRoleId(DISTRIBUTION()));
+          _authorize(functions, InstanceStore.createDistributorType.selector, "createDistributorType");
+          _authorize(functions, InstanceStore.updateDistributorType.selector, "updateDistributorType");
+          _authorize(functions, InstanceStore.updateDistributorTypeState.selector, "updateDistributorTypeState");
+          _authorize(functions, InstanceStore.createDistributor.selector, "createDistributor");
+          _authorize(functions, InstanceStore.updateDistributor.selector, "updateDistributor");
+          _authorize(functions, InstanceStore.updateDistributorState.selector, "updateDistributorState");
+          _authorize(functions, InstanceStore.createReferral.selector, "createReferral");
+          _authorize(functions, InstanceStore.updateReferral.selector, "updateReferral");
+          _authorize(functions, InstanceStore.updateReferralState.selector, "updateReferralState");
+
+          // authorize oracle service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, _getServiceRoleId(ORACLE()));
+          _authorize(functions, InstanceStore.createRequest.selector, "createRequest");
+          _authorize(functions, InstanceStore.updateRequest.selector, "updateRequest");
+          _authorize(functions, InstanceStore.updateRequestState.selector, "updateRequestState");
+
+          // authorize pool service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, _getServiceRoleId(POOL()));
+          _authorize(functions, InstanceStore.updatePool.selector, "updatePool");
+
+          // authorize bundle service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, _getServiceRoleId(BUNDLE()));
+          _authorize(functions, InstanceStore.createBundle.selector, "createBundle");
+          _authorize(functions, InstanceStore.updateBundle.selector, "updateBundle");
+          _authorize(functions, InstanceStore.updateBundleState.selector, "updateBundleState");
+          _authorize(functions, InstanceStore.increaseLocked.selector, "increaseLocked");
+          _authorize(functions, InstanceStore.decreaseLocked.selector, "decreaseLocked");
+
+          // authorize product service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, _getServiceRoleId(PRODUCT()));
+          _authorize(functions, InstanceStore.createRisk.selector, "createRisk");
+          _authorize(functions, InstanceStore.updateRisk.selector, "updateRisk");
+          _authorize(functions, InstanceStore.updateRiskState.selector, "updateRiskState");
+
+          // authorize application service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, _getServiceRoleId(APPLICATION()));
+          _authorize(functions, InstanceStore.createApplication.selector, "createApplication");
+          _authorize(functions, InstanceStore.updateApplication.selector, "updateApplication");
+          _authorize(functions, InstanceStore.updateApplicationState.selector, "updateApplicationState");
+
+          // authorize policy service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, _getServiceRoleId(POLICY()));
+          _authorize(functions, InstanceStore.updatePolicy.selector, "updatePolicy");
+          _authorize(functions, InstanceStore.updatePolicyState.selector, "updatePolicyState");
+
+          // authorize claim service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, _getServiceRoleId(CLAIM()));
+          _authorize(functions, InstanceStore.updatePolicyClaims.selector, "updatePolicyClaims");
+          _authorize(functions, InstanceStore.createClaim.selector, "createClaim");
+          _authorize(functions, InstanceStore.updateClaim.selector, "updateClaim");
+          _authorize(functions, InstanceStore.createPayout.selector, "createPayout");
+          _authorize(functions, InstanceStore.updatePayout.selector, "updatePayout");
+     }
+}
+

package/contracts/instance/InstanceAuthorizationsLib.sol

@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {ADMIN_ROLE, INSTANCE_OWNER_ROLE, DISTRIBUTION_OWNER_ROLE, POOL_OWNER_ROLE, PRODUCT_OWNER_ROLE, INSTANCE_SERVICE_ROLE, COMPONENT_SERVICE_ROLE, DISTRIBUTION_SERVICE_ROLE, POOL_SERVICE_ROLE, PRODUCT_SERVICE_ROLE, APPLICATION_SERVICE_ROLE, POLICY_SERVICE_ROLE, CLAIM_SERVICE_ROLE, BUNDLE_SERVICE_ROLE, INSTANCE_ROLE} from "../type/RoleId.sol";
-import {APPLICATION, BUNDLE, CLAIM, COMPONENT, DISTRIBUTION, INSTANCE, POLICY, POOL, PRODUCT, REGISTRY} from "../type/ObjectType.sol";
+import {ADMIN_ROLE, INSTANCE_OWNER_ROLE, ORACLE_SERVICE_ROLE, DISTRIBUTION_OWNER_ROLE, POOL_OWNER_ROLE, PRODUCT_OWNER_ROLE, ORACLE_OWNER_ROLE, INSTANCE_SERVICE_ROLE, COMPONENT_SERVICE_ROLE, DISTRIBUTION_SERVICE_ROLE, POOL_SERVICE_ROLE, PRODUCT_SERVICE_ROLE, APPLICATION_SERVICE_ROLE, POLICY_SERVICE_ROLE, CLAIM_SERVICE_ROLE, BUNDLE_SERVICE_ROLE, INSTANCE_ROLE} from "../type/RoleId.sol";
+import {APPLICATION, BUNDLE, CLAIM, COMPONENT, DISTRIBUTION, INSTANCE, ORACLE, POLICY, POOL, PRODUCT, REGISTRY} from "../type/ObjectType.sol";
 import {VersionPart} from "../type/Version.sol";
 
 import {IRegistry} from "../registry/IRegistry.sol";
@@ -31,6 +31,7 @@ library InstanceAuthorizationsLib
         _createRoles(instanceAdmin);
         _createTargets(instanceAdmin, instance, bundleManager, instanceStore);
         _grantComponentServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
+        _grantOracleServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
         _grantDistributionServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
         _grantPoolServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
         _grantProductServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
@@ -49,6 +50,7 @@ library InstanceAuthorizationsLib
         instanceAdmin.createCoreRole(INSTANCE_SERVICE_ROLE(), "InstanceServiceRole");
         instanceAdmin.createCoreRole(COMPONENT_SERVICE_ROLE(), "ComponentServiceRole");
         instanceAdmin.createCoreRole(DISTRIBUTION_SERVICE_ROLE(), "DistributionServiceRole");
+        instanceAdmin.createCoreRole(ORACLE_SERVICE_ROLE(), "OracleServiceRole");
         instanceAdmin.createCoreRole(POOL_SERVICE_ROLE(), "PoolServiceRole");
         instanceAdmin.createCoreRole(APPLICATION_SERVICE_ROLE(), "ApplicationServiceRole");
         instanceAdmin.createCoreRole(PRODUCT_SERVICE_ROLE(), "ProductServiceRole");
@@ -58,6 +60,7 @@ library InstanceAuthorizationsLib
 
         // default roles controlled by INSTANCE_OWNER_ROLE -> gif roles
         instanceAdmin.createGifRole(DISTRIBUTION_OWNER_ROLE(), "DistributionOwnerRole", INSTANCE_OWNER_ROLE());
+        instanceAdmin.createGifRole(ORACLE_OWNER_ROLE(), "OracleOwnerRole", INSTANCE_OWNER_ROLE());
         instanceAdmin.createGifRole(POOL_OWNER_ROLE(), "PoolOwnerRole", INSTANCE_OWNER_ROLE());
         instanceAdmin.createGifRole(PRODUCT_OWNER_ROLE(), "ProductOwnerRole", INSTANCE_OWNER_ROLE());
     }
@@ -102,12 +105,37 @@ library InstanceAuthorizationsLib
             COMPONENT_SERVICE_ROLE());
     }
 
+    function _grantOracleServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        InstanceStore instanceStore,
+        IRegistry registry,
+        VersionPart majorVersion
+    )
+        private
+    {
+        // configure authorization for distribution service on instance
+        address oracleServiceAddress = registry.getServiceAddress(ORACLE(), majorVersion);
+        accessManager.grantRole(ORACLE_SERVICE_ROLE().toInt(), oracleServiceAddress, 0);
+
+        bytes4[] memory instanceOracleServiceSelectors = new bytes4[](3);
+        instanceOracleServiceSelectors[0] = instanceStore.createRequest.selector;
+        instanceOracleServiceSelectors[1] = instanceStore.updateRequest.selector;
+        instanceOracleServiceSelectors[2] = instanceStore.updateRequestState.selector;
+
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            instanceOracleServiceSelectors,
+            ORACLE_SERVICE_ROLE());
+    }
+
     function _grantDistributionServiceAuthorizations(
         AccessManagerExtendedInitializeable accessManager,
         InstanceAdmin instanceAdmin,
         InstanceStore instanceStore,
         IRegistry registry,
-        VersionPart majorVersion)
+        VersionPart majorVersion
+    )
         private
     {
         // configure authorization for distribution service on instance

package/contracts/instance/InstanceReader.sol

@@ -9,13 +9,15 @@ import {DistributorType} from "../type/DistributorType.sol";
 import {Fee, FeeLib} from "../type/Fee.sol";
 import {Key32} from "../type/Key32.sol";
 import {NftId} from "../type/NftId.sol";
-import {ObjectType, COMPONENT, DISTRIBUTOR, DISTRIBUTION, INSTANCE, PRODUCT, POLICY, POOL, FEE, BUNDLE} from "../type/ObjectType.sol";
+import {ObjectType, COMPONENT, DISTRIBUTOR, DISTRIBUTION, INSTANCE, PRODUCT, POLICY, POOL, BUNDLE} from "../type/ObjectType.sol";
 import {PayoutId} from "../type/PayoutId.sol";
 import {ReferralId, ReferralStatus, ReferralLib, REFERRAL_OK, REFERRAL_ERROR_UNKNOWN, REFERRAL_ERROR_EXPIRED, REFERRAL_ERROR_EXHAUSTED} from "../type/Referral.sol";
+import {RequestId} from "../type/RequestId.sol";
 import {RiskId} from "../type/RiskId.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {StateId} from "../type/StateId.sol";
 import {UFixed, MathLib, UFixedLib} from "../type/UFixed.sol";
 import {Version} from "../type/Version.sol";
-import {StateId} from "../type/StateId.sol";
 
 import {IRegistry} from "../registry/IRegistry.sol";
 import {IBundle} from "../instance/module/IBundle.sol";
@@ -23,6 +25,7 @@ import {IComponents} from "../instance/module/IComponents.sol";
 import {IDistribution} from "../instance/module/IDistribution.sol";
 import {IInstance} from "./IInstance.sol";
 import {IKeyValueStore} from "../shared/IKeyValueStore.sol";
+import {IOracle} from "../oracle/IOracle.sol";
 import {IPolicy} from "../instance/module/IPolicy.sol";
 import {IRisk} from "../instance/module/IRisk.sol";
 import {TimestampLib} from "../type/Timestamp.sol";
@@ -257,6 +260,16 @@ contract InstanceReader {
         }
     }
 
+    function getRequestInfo(RequestId requestId)
+        public
+        view
+        returns (IOracle.RequestInfo memory requestInfo)
+    {
+        bytes memory data = _store.getData(requestId.toKey32());
+        if (data.length > 0) {
+            return abi.decode(data, (IOracle.RequestInfo));
+        }
+    }
 
     function getMetadata(Key32 key)
         public 
@@ -266,6 +279,14 @@ contract InstanceReader {
         return _store.getMetadata(key);
     }
 
+    function getState(Key32 key)
+        public 
+        view 
+        returns (StateId state)
+    {
+        return _store.getMetadata(key).state;
+    }
+
 
     function toReferralId(
         NftId distributionNftId,
@@ -317,6 +338,12 @@ contract InstanceReader {
     }
 
 
+    function hasRole(address account, RoleId roleId) public view returns (bool isMember) {
+        (isMember, ) = _instance.getInstanceAccessManager().hasRole(
+            roleId.toInt(), account);
+    }
+
+
     function toPolicyKey(NftId policyNftId) public pure returns (Key32) { 
         return policyNftId.toKey32(POLICY());
     }