@etherisc/gif-next 0.0.2-9a02a95-445 → 0.0.2-9a3c303-522

package/contracts/authorization/AccessAdminLib.sol

@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {AccessManagedUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagedUpgradeable.sol";
+
+import {IAccess} from "./IAccess.sol";
+import {IAccessAdmin} from "./IAccessAdmin.sol";
+import {IAuthorization} from "./IAuthorization.sol";
+import {IRegistry} from "../registry/IRegistry.sol";
+
+import {ContractLib} from "../shared/ContractLib.sol";
+import {ObjectType} from "../type/ObjectType.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {SelectorLib} from "../type/Selector.sol";
+import {Str, StrLib} from "../type/String.sol";
+import {TimestampLib} from "../type/Timestamp.sol";
+import {VersionPart} from "../type/Version.sol";
+
+
+library AccessAdminLib { // ACCESS_ADMIN_LIB
+
+    function checkRoleCreation(
+        IAccessAdmin accessAdmin,
+        RoleId roleId, 
+        IAccess.RoleInfo memory info
+    )
+        public 
+        view
+    {
+        // check role does not yet exist    // ACCESS_ADMIN_LIB role creation checks
+        if(accessAdmin.roleExists(roleId)) {
+            revert IAccessAdmin.ErrorAccessAdminRoleAlreadyCreated(
+                roleId, 
+                accessAdmin.getRoleInfo(roleId).name.toString());
+        }
+
+        // check admin role exists
+        if(!accessAdmin.roleExists(info.adminRoleId)) {
+            revert IAccessAdmin.ErrorAccessAdminRoleAdminNotExisting(info.adminRoleId);
+        }
+
+        // check role name is not empty
+        if(info.name.length() == 0) {
+            revert IAccessAdmin.ErrorAccessAdminRoleNameEmpty(roleId);
+        }
+
+        // check role name is not used for another role
+        RoleId roleIdForName = accessAdmin.getRoleForName(StrLib.toString(info.name));
+        if(roleIdForName.gtz()) {
+            revert IAccessAdmin.ErrorAccessAdminRoleNameAlreadyExists(
+                roleId, 
+                info.name.toString(),
+                roleIdForName);
+        }
+    }
+
+    function checkTargetCreation(
+        IAccessAdmin accessAdmin,
+        address target, 
+        string memory targetName, 
+        bool checkAuthority
+    )
+        public 
+        view
+    {
+        // check target does not yet exist
+        if(accessAdmin.targetExists(target)) {
+            revert IAccessAdmin.ErrorAccessAdminTargetAlreadyCreated(
+                target, 
+                accessAdmin.getTargetInfo(target).name.toString());
+        }
+
+        // check target name is not empty
+        Str name = StrLib.toStr(targetName);
+        if(name.length() == 0) {
+            revert IAccessAdmin.ErrorAccessAdminTargetNameEmpty(target);
+        }
+
+        // check target name is not used for another target
+        address targetForName = accessAdmin.getTargetForName(name);
+        if(targetForName != address(0)) {
+            revert IAccessAdmin.ErrorAccessAdminTargetNameAlreadyExists(
+                target, 
+                targetName,
+                targetForName);
+        }
+
+        // check target is an access managed contract
+        if (!ContractLib.isAccessManaged(target)) {
+            revert IAccessAdmin.ErrorAccessAdminTargetNotAccessManaged(target);
+        }
+
+        // check target shares authority with this contract
+        if (checkAuthority) {
+            address targetAuthority = AccessManagedUpgradeable(target).authority();
+            if (targetAuthority != accessAdmin.authority()) {
+                revert IAccessAdmin.ErrorAccessAdminTargetAuthorityMismatch(accessAdmin.authority(), targetAuthority);
+            }
+        }
+
+    }
+
+
+    function checkAuthorization( 
+        address authorizationOld,
+        address authorization,
+        ObjectType expectedDomain, 
+        VersionPart expectedRelease,
+        bool checkAlreadyInitialized
+    )
+        public
+        view
+    {
+        // checks
+        // check not yet initialized
+        if (checkAlreadyInitialized && authorizationOld != address(0)) {
+            revert IAccessAdmin.ErrorAccessAdminAlreadyInitialized(authorizationOld);
+        }
+
+        // check contract type matches
+        if (!ContractLib.supportsInterface(authorization, type(IAuthorization).interfaceId)) {  
+            revert IAccessAdmin.ErrorAccessAdminNotAuthorization(authorization);
+        }
+
+        // check domain matches
+        ObjectType domain = IAuthorization(authorization).getDomain();
+        if (domain != expectedDomain) {
+            revert IAccessAdmin.ErrorAccessAdminDomainMismatch(authorization, expectedDomain, domain);
+        }
+
+        // check release matches
+        VersionPart authorizationRelease = IAuthorization(authorization).getRelease();
+        if (authorizationRelease != expectedRelease) {
+            revert IAccessAdmin.ErrorAccessAdminReleaseMismatch(authorization, expectedRelease, authorizationRelease);
+        }
+    }
+
+
+    function checkIsRegistered( 
+        address registry,
+        address target,
+        ObjectType expectedType
+    )
+        public
+        view 
+    {
+        ObjectType tagetType = IRegistry(registry).getObjectInfo(target).objectType;
+        if (tagetType.eqz()) {
+            revert IAccessAdmin.ErrorAccessAdminNotRegistered(target);
+        }
+
+        if (tagetType != expectedType) {
+            revert IAccessAdmin.ErrorAccessAdminTargetTypeMismatch(target, expectedType, tagetType);
+        }
+    }
+
+    function toRole(RoleId adminRoleId, IAccessAdmin.RoleType roleType, uint32 maxMemberCount, string memory name)
+        public 
+        view 
+        returns (IAccess.RoleInfo memory)
+    { 
+        return IAccess.RoleInfo({
+            name: StrLib.toStr(name),
+            adminRoleId: adminRoleId,
+            roleType: roleType,
+            maxMemberCount: maxMemberCount,
+            createdAt: TimestampLib.blockTimestamp(),
+            pausedAt: TimestampLib.max()
+        });
+    }
+
+    function toFunction(bytes4 selector, string memory name) 
+        public 
+        view 
+        returns (IAccess.FunctionInfo memory) 
+    { 
+        return IAccess.FunctionInfo({
+            name: StrLib.toStr(name),
+            selector: SelectorLib.toSelector(selector),
+            createdAt: TimestampLib.blockTimestamp()});
+    }
+
+}

package/contracts/authorization/AccessManagerCloneable.sol

@@ -0,0 +1,158 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import {AccessManagerUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagerUpgradeable.sol";
+import {IAccessManager} from "@openzeppelin/contracts/access/manager/IAccessManager.sol";
+
+import {InitializableERC165} from "../shared/InitializableERC165.sol";
+import {RegistryLinked} from "../shared/RegistryLinked.sol";
+import {VersionPart} from "../type/Version.sol";
+
+
+/// @dev An AccessManager based on OpenZeppelin that is cloneable and has a central lock property.
+/// The lock property allows to lock all services of a release in a central place.
+/// Cloned by upon release preparation and instance cloning.
+contract AccessManagerCloneable is
+    AccessManagerUpgradeable,
+    InitializableERC165,
+    RegistryLinked
+{
+    error ErrorAccessManagerCallerNotAdmin(address caller);
+    error ErrorAccessManagerRegistryAlreadySet(address registry);
+    error ErrorAccessManagerInvalidRelease(VersionPart release);
+
+    error ErrorAccessManagerTargetAdminLocked(address target);
+    error ErrorAccessManagerCallerAdminLocked(address caller);
+
+    VersionPart private _release;
+    bool private _isLocked;
+
+
+    modifier onlyAdminRole() {
+        (bool isMember, ) = hasRole(ADMIN_ROLE, msg.sender);
+        if(!isMember) {
+            revert ErrorAccessManagerCallerNotAdmin(msg.sender);
+        }
+        _;
+    }
+
+
+    function initialize(address admin)
+        public
+        initializer()
+    {
+        __ERC165_init();
+        __AccessManager_init(admin);
+
+        _registerInterface(type(IAccessManager).interfaceId);
+    }
+
+
+    /// @dev Completes the setup of the access manager.
+    /// Links the access manager to the registry and sets the release version.
+    function completeSetup(
+        address registry, 
+        VersionPart release
+    )
+        external
+        onlyAdminRole
+        reinitializer(uint64(release.toInt()))
+    {
+        _checkAndSetRegistry(registry);
+        _checkAndSetRelease(release);
+    }
+
+    // /// @dev Completes the setup of the access manager.
+    // /// Links the access manager to the registry and sets the release version.
+    // function completeSetup(
+    //     address registry, 
+    //     VersionPart release,
+    //     bool verifyRelease
+    // )
+    //     public
+    //     onlyAdminRole
+    //     reinitializer(uint64(release.toInt()))
+    // {
+    //     _checkAndSetRegistry(registry);
+
+    //     if (verifyRelease) {
+    //         _checkAndSetRelease(release);
+    //     }
+    // }
+
+    /// @dev Returns true if the caller is authorized to call the target with the given selector and the manager lock is not set to locked.
+    /// Feturn values as in OpenZeppelin AccessManager.
+    /// For a locked manager the function reverts with ErrorAccessManagerTargetAdminLocked.
+    function canCall(
+        address caller,
+        address target,
+        bytes4 selector
+    )
+        public 
+        view 
+        virtual override 
+        returns (
+            bool immediate, 
+            uint32 delay
+        ) 
+    {
+        // locking of all contracts under control of this access manager
+        if (_isLocked) {
+            revert ErrorAccessManagerTargetAdminLocked(target);
+        }
+
+        (immediate, delay) = super.canCall(caller, target, selector);
+    }
+
+
+    /// @dev Locks/unlocks all services of this access manager.
+    /// Only the corresponding access admin can lock/unlock the services.
+    function setLocked(bool locked)
+        external
+        onlyAdminRole() 
+    {
+        _isLocked = locked;
+    }
+
+
+    /// @dev Returns the release version of this access manager.
+    /// For the registry admin release 3 is returned.
+    /// For the release admin and the instance admin the actual release version is returned.
+    function getRelease() external view returns (VersionPart release) {
+        return _release;
+    }
+
+
+    /// @dev Returns true iff all contracts of this access manager are locked.
+    function isLocked()
+        public
+        view
+        returns (bool)
+    {
+        return _isLocked;
+    }
+
+
+    function _checkAndSetRelease(VersionPart release)
+        internal
+    {
+        if (!release.isValidRelease()) {
+            revert ErrorAccessManagerInvalidRelease(release);
+        }
+
+        _release = release;
+    }
+
+
+    function _checkAndSetRegistry(address registry)
+        internal
+    {
+        // checks
+        if(address(getRegistry()) != address(0)) {
+            revert ErrorAccessManagerRegistryAlreadySet(address(getRegistry()) );
+        }
+
+        // effects
+        __RegistryLinked_init(registry);
+    }
+}

package/contracts/authorization/Authorization.sol

@@ -0,0 +1,365 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IAccess} from "./IAccess.sol";
+import {IAuthorization} from "./IAuthorization.sol";
+
+import {InitializableERC165} from "../shared/InitializableERC165.sol";
+import {ObjectType, ObjectTypeLib} from "../type/ObjectType.sol";
+import {RoleId, RoleIdLib, ADMIN_ROLE} from "../type/RoleId.sol";
+import {SelectorLib} from "../type/Selector.sol";
+import {Str, StrLib} from "../type/String.sol";
+import {TimestampLib} from "../type/Timestamp.sol";
+import {VersionPart, VersionPartLib} from "../type/Version.sol";
+
+contract Authorization is
+    InitializableERC165,
+    IAuthorization
+{
+    uint256 public constant GIF_RELEASE = 3;
+
+    string public constant ROLE_NAME_SUFFIX = "Role";
+    string public constant SERVICE_ROLE_NAME_SUFFIX = "ServiceRole";
+
+    uint64 internal _nextGifContractRoleId;
+    ObjectType[] internal _serviceDomains;
+    mapping(ObjectType domain => Str target) internal _serviceTarget;
+
+    string internal _mainTargetName = "Component";
+    string internal _tokenHandlerName = "ComponentTH";
+
+    ObjectType internal _domain;
+    Str internal _mainTarget;
+    Str internal _tokenHandlerTarget;
+    Str[] internal _targets;
+
+    mapping(Str target => RoleId roleid) internal _targetRole;
+    mapping(Str target => bool exists) internal _targetExists;
+
+    RoleId[] internal _roles;
+    mapping(RoleId role => RoleInfo info) internal _roleInfo;
+
+    mapping(Str target => RoleId[] authorizedRoles) internal _authorizedRoles;
+    mapping(Str target => mapping(RoleId authorizedRole => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
+
+
+    constructor(
+        string memory mainTargetName, 
+        ObjectType targetDomain, 
+        bool isComponent,
+        bool includeTokenHandler
+    )
+    {
+        // checks
+        if (bytes(mainTargetName).length == 0) {
+            revert ErrorAuthorizationMainTargetNameEmpty();
+        }
+
+        if (targetDomain == ObjectTypeLib.zero()) {
+            revert ErrorAuthorizationTargetDomainZero();
+        }
+
+        // effects
+        _initializeERC165();
+
+        _domain = targetDomain;
+        _mainTargetName = mainTargetName;
+        _mainTarget = StrLib.toStr(mainTargetName);
+        _nextGifContractRoleId = 10;
+
+        if (isComponent) {
+            if (targetDomain.eqz()) {
+                revert ErrorAuthorizationTargetDomainZero();
+            }
+
+            RoleId mainRoleId = RoleIdLib.toComponentRoleId(targetDomain, 0);
+            string memory mainRolName = _toTargetRoleName(_mainTargetName);
+
+            _addTargetWithRole(
+                _mainTargetName, 
+                mainRoleId,
+                mainRolName);
+        } else {
+            _addGifContractTarget(_mainTargetName);
+        }
+        // setup use case specific parts
+        _setupServiceTargets();
+        _setupRoles(); // not including main target role
+        _setupTargets(); // not including main target (and token handler target)
+        _setupTargetAuthorizations(); // not including token handler target
+
+        // setup component token handler 
+        if (includeTokenHandler) {
+            _tokenHandlerName = string(abi.encodePacked(mainTargetName, "TH"));
+            _tokenHandlerTarget = StrLib.toStr(_tokenHandlerName);
+            _addTarget(_tokenHandlerName);
+            _setupTokenHandlerAuthorizations();
+        }
+
+        _registerInterfaceNotInitializing(type(IAuthorization).interfaceId);
+    }
+
+    function getDomain() external view returns(ObjectType targetDomain) {
+        return _domain;
+    }
+
+    function getServiceDomains() external view returns(ObjectType[] memory serviceDomains) {
+        return _serviceDomains;
+    }
+
+    function getComponentRole(ObjectType componentDomain) public view returns(RoleId roleId) {
+        return RoleIdLib.toComponentRoleId(componentDomain, 0);
+    }
+
+    function getServiceRole(ObjectType serviceDomain) public virtual pure returns (RoleId serviceRoleId) {
+        return RoleIdLib.roleForTypeAndVersion(
+            serviceDomain, 
+            getRelease());
+    }
+
+    function getServiceTarget(ObjectType serviceDomain) external view returns(Str serviceTarget) {
+        return _serviceTarget[serviceDomain];
+    }
+
+    function getRoles() external view returns(RoleId[] memory roles) {
+        return _roles;
+    }
+
+    function roleExists(RoleId roleId) public view returns(bool exists) {
+        return _roleInfo[roleId].roleType != RoleType.Undefined;
+    }
+
+    function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory info) {
+        return _roleInfo[roleId];
+    }
+
+    function getMainTargetName() public virtual view returns (string memory name) {
+        return _mainTargetName;
+    }
+
+    function getMainTarget() public view returns(Str) {
+        return _mainTarget;
+    }
+
+    function getTokenHandlerName() public view returns(string memory) {
+        return _tokenHandlerName;
+    }
+
+    function getTokenHandlerTarget() public view returns(Str) {
+        return _tokenHandlerTarget;
+    }
+
+    function getTarget(string memory targetName) public view returns(Str target) {
+        return StrLib.toStr(targetName);
+    }
+
+    function getTargets() external view returns(Str[] memory targets) {
+        return _targets;
+    }
+
+    function targetExists(Str target) external view returns(bool exists) {
+        return target == _mainTarget || _targetExists[target];
+    }
+
+    function getTargetRole(Str target) public view returns(RoleId roleId) {
+        return _targetRole[target];
+    }
+
+    function getAuthorizedRoles(Str target) external view returns(RoleId[] memory roleIds) {
+        return _authorizedRoles[target];
+    }
+
+    function getAuthorizedFunctions(Str target, RoleId roleId) external view returns(IAccess.FunctionInfo[] memory authorizatedFunctions) {
+        return _authorizedFunctions[target][roleId];
+    }
+
+    function getRelease() public virtual pure returns(VersionPart release) {
+        return VersionPartLib.toVersionPart(GIF_RELEASE);
+    }
+
+    /// @dev Sets up the relevant service targets for the component.
+    /// Overwrite this function for use case specific authorizations.
+    function _setupServiceTargets() internal virtual { }
+
+    /// @dev Sets up the relevant (non-service) targets for the component.
+    /// Overwrite this function for use case specific authorizations.
+    function _setupTargets() internal virtual { }
+
+    /// @dev Sets up the relevant roles for the component.
+    /// Overwrite this function for use case specific authorizations.
+    function _setupRoles() internal virtual {}
+
+    /// @dev Sets up the relevant component's token handler authorizations.
+    /// Overwrite this function for use case specific authorizations.
+    function _setupTokenHandlerAuthorizations() internal virtual {}
+
+    /// @dev Sets up the relevant target authorizations for the component.
+    /// Overwrite this function for use case specific authorizations.
+    function _setupTargetAuthorizations() internal virtual {}
+
+    function _addGifContractTarget(string memory contractName) internal {
+
+        RoleId contractRoleId = RoleIdLib.toRoleId(_nextGifContractRoleId++);
+        string memory contractRoleName = string(
+            abi.encodePacked(
+                contractName,
+                ROLE_NAME_SUFFIX));
+
+        _addTargetWithRole(
+            contractName,
+            contractRoleId,
+            contractRoleName);
+    }
+
+    /// @dev Add the service target role for the specified service domain
+    function _addServiceTargetWithRole(ObjectType serviceDomain) internal {
+        // add service domain
+        _serviceDomains.push(serviceDomain);
+
+        // get versioned target name
+        string memory serviceTargetName = ObjectTypeLib.toVersionedName(
+                ObjectTypeLib.toName(serviceDomain), 
+                "Service", 
+                getRelease());
+
+        _serviceTarget[serviceDomain] = StrLib.toStr(serviceTargetName);
+
+        RoleId serviceRoleId = getServiceRole(serviceDomain);
+        string memory serviceRoleName = ObjectTypeLib.toVersionedName(
+                ObjectTypeLib.toName(serviceDomain), 
+                "ServiceRole", 
+                getRelease());
+
+        _addTargetWithRole(
+            serviceTargetName,
+            serviceRoleId,
+            serviceRoleName);
+    }
+
+
+    /// @dev Use this method to to add an authorized role.
+    function _addRole(RoleId roleId, RoleInfo memory info) internal {
+        _roles.push(roleId);
+        _roleInfo[roleId] = info;
+    }
+
+
+    /// @dev Add a contract role for the provided role id and name.
+    function _addContractRole(RoleId roleId, string memory name) internal {
+        _addRole(
+            roleId,
+            _toRoleInfo(
+                ADMIN_ROLE(),
+                RoleType.Contract,
+                1,
+                name));
+    }
+
+
+    /// @dev Add the versioned service role for the specified service domain
+    function _addServiceRole(ObjectType serviceDomain) internal {
+        _addContractRole(
+            getServiceRole(serviceDomain),
+            ObjectTypeLib.toVersionedName(
+                ObjectTypeLib.toName(serviceDomain), 
+                SERVICE_ROLE_NAME_SUFFIX, 
+                getRelease()));
+    }
+
+
+    /// @dev Add a contract role for the provided role id and name.
+    function _addCustomRole(RoleId roleId, RoleId adminRoleId, uint32 maxMemberCount, string memory name) internal {
+        _addRole(
+            roleId,
+            _toRoleInfo(
+                adminRoleId,
+                RoleType.Custom,
+                maxMemberCount,
+                name));
+    }
+
+
+    /// @dev Use this method to to add an authorized target together with its target role.
+    function _addTargetWithRole(
+        string memory targetName, 
+        RoleId roleId, 
+        string memory roleName
+    )
+        internal
+    {
+        // add target
+        Str target = StrLib.toStr(targetName);
+        _targets.push(target);
+
+        _targetExists[target] = true;
+
+        // link role to target if defined
+        if (roleId != RoleIdLib.zero()) {
+            // add role if new
+            if (!roleExists(roleId)) {
+                _addContractRole(roleId, roleName);
+            }
+
+            // link target to role
+            _targetRole[target] = roleId;
+        }
+    }
+
+
+    /// @dev Use this method to to add an authorized target.
+    function _addTarget(string memory name) internal {
+        _addTargetWithRole(name, RoleIdLib.zero(), "");
+    }
+
+
+    /// @dev Use this method to authorize the specified role to access the target.
+    function _authorizeForTarget(string memory target, RoleId authorizedRoleId)
+        internal
+        returns (IAccess.FunctionInfo[] storage authorizatedFunctions)
+    {
+        Str targetStr = StrLib.toStr(target);
+        _authorizedRoles[targetStr].push(authorizedRoleId);
+        return _authorizedFunctions[targetStr][authorizedRoleId];
+    }
+
+
+    /// @dev Use this method to authorize a specific function authorization
+    function _authorize(IAccess.FunctionInfo[] storage functions, bytes4 selector, string memory name) internal {
+        functions.push(
+            IAccess.FunctionInfo({
+                selector: SelectorLib.toSelector(selector),
+                name: StrLib.toStr(name),
+                createdAt: TimestampLib.blockTimestamp()}));
+    }
+
+
+    /// @dev role id for targets registry, staking and instance
+    function _toTargetRoleId(ObjectType targetDomain) 
+        internal
+        pure
+        returns (RoleId targetRoleId)
+    {
+        return RoleIdLib.roleForType(targetDomain);
+    }
+
+
+    function _toTargetRoleName(string memory targetName) internal pure returns (string memory) {
+        return string(
+            abi.encodePacked(
+                targetName,
+                ROLE_NAME_SUFFIX));
+    }
+
+
+    /// @dev creates a role info object from the provided parameters
+    function _toRoleInfo(RoleId adminRoleId, RoleType roleType, uint32 maxMemberCount, string memory name) internal view returns (RoleInfo memory info) {
+        return RoleInfo({
+            name: StrLib.toStr(name),
+            adminRoleId: adminRoleId,
+            roleType: roleType,
+            maxMemberCount: maxMemberCount,
+            createdAt: TimestampLib.blockTimestamp(),
+            pausedAt: TimestampLib.max()});
+    }
+}
+