@etherisc/gif-next 0.0.2-b28f7c7-340 → 0.0.2-b2e620f-736

package/contracts/registry/RegistryService.sol

@@ -1,49 +1,26 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {ERC165Checker} from "@openzeppelin/contracts/utils/introspection/ERC165Checker.sol";
-// import {AccessManagedUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagedUpgradeable.sol";
-
-import {IRegistry} from "./IRegistry.sol";
+import {IComponent} from "../../contracts/shared/IComponent.sol";
+import {IDistributionComponent} from "../../contracts/distribution/IDistributionComponent.sol";
 import {IInstance} from "../instance/IInstance.sol";
-
-import {ContractDeployerLib} from "../shared/ContractDeployerLib.sol";
-import {IComponent} from "../../contracts/components/IComponent.sol";
-import {IPoolComponent} from "../../contracts/components/IPoolComponent.sol";
-import {IProductComponent} from "../../contracts/components/IProductComponent.sol";
-import {IDistributionComponent} from "../../contracts/components/IDistributionComponent.sol";
-
-import {IVersionable} from "../../contracts/shared/IVersionable.sol";
-import {Versionable} from "../../contracts/shared/Versionable.sol";
+import {IPoolComponent} from "../../contracts/pool/IPoolComponent.sol";
+import {IProductComponent} from "../../contracts/product/IProductComponent.sol";
 import {IRegisterable} from "../../contracts/shared/IRegisterable.sol";
-import {Registerable} from "../../contracts/shared/Registerable.sol";
-
-import {RoleId, PRODUCT_OWNER_ROLE, POOL_OWNER_ROLE, ORACLE_OWNER_ROLE} from "../../contracts/types/RoleId.sol";
-import {ObjectType, REGISTRY, SERVICE, PRODUCT, ORACLE, POOL, INSTANCE, DISTRIBUTION, DISTRIBUTOR, APPLICATION, POLICY, CLAIM, BUNDLE, STAKE} from "../../contracts/types/ObjectType.sol";
-import {StateId, ACTIVE, PAUSED} from "../../contracts/types/StateId.sol";
-import {NftId, NftIdLib, zeroNftId} from "../../contracts/types/NftId.sol";
-import {Fee, FeeLib} from "../../contracts/types/Fee.sol";
-import {Version, VersionPart, VersionLib} from "../../contracts/types/Version.sol";
+import {IRegistry} from "./IRegistry.sol";
+import {IRegistryService} from "./IRegistryService.sol";
 
+import {ObjectType, REGISTRY, SERVICE, PRODUCT, ORACLE, POOL, INSTANCE, COMPONENT, DISTRIBUTION, DISTRIBUTOR, APPLICATION, POLICY, CLAIM, BUNDLE, STAKE, STAKING, PRICE} from "../../contracts/type/ObjectType.sol";
+import {NftId, NftIdLib} from "../../contracts/type/NftId.sol";
 import {Service} from "../shared/Service.sol";
-import {IService} from "../shared/IService.sol";
-import {IRegistryService} from "./IRegistryService.sol";
-import {Registry} from "./Registry.sol";
 
 contract RegistryService is
     Service,
     IRegistryService
 {
-    using NftIdLib for NftId;
-
     // TODO update to real hash when registry is stable
     bytes32 public constant REGISTRY_CREATION_CODE_HASH = bytes32(0);
 
-    // From IService
-    function getDomain() public pure override returns(ObjectType serviceDomain) {
-        return REGISTRY(); 
-    }
-
     // from Versionable
 
     /// @dev top level initializer
@@ -56,24 +33,38 @@ contract RegistryService is
         initializer()
     {
         (
-            address registryAddress,
-            address initialAuthority
+            address authority,
+            address registry
         ) = abi.decode(data, (address, address));
 
-        initializeService(registryAddress, initialAuthority, owner);
+        __Service_init(authority, registry, owner);
+        _registerInterface(type(IRegistryService).interfaceId);
+    }
+
 
-        registerInterface(type(IRegistryService).interfaceId);
+    function registerStaking(IRegisterable staking, address owner)
+        external
+        virtual
+        restricted()
+        returns(
+            IRegistry.ObjectInfo memory info
+        )
+    {
+        info = _getAndVerifyContractInfo(staking, STAKING(), owner);
+        info.nftId = getRegistry().register(info);
     }
 
+
     function registerInstance(IRegisterable instance, address owner)
         external
-        restricted
+        virtual
+        restricted()
         returns(
             IRegistry.ObjectInfo memory info
         ) 
     {
         if(!instance.supportsInterface(type(IInstance).interfaceId)) {
-            revert NotInstance();
+            revert ErrorRegistryServiceNotInstance(address(instance));
         }
 
         info = _getAndVerifyContractInfo(instance, INSTANCE(), owner);
@@ -82,55 +73,54 @@ contract RegistryService is
         instance.linkToRegisteredNftId(); // asume safe
     }
 
-    function registerProduct(IComponent product, address owner)
+    function registerProduct(
+        IComponent product, 
+        address initialOwner
+    )
         external
-        restricted
+        virtual
+        restricted()
         returns(
             IRegistry.ObjectInfo memory info
         ) 
     {
-        // CAN revert if no ERC165 support -> will revert with empty message 
         if(!product.supportsInterface(type(IProductComponent).interfaceId)) {
-            revert NotProduct();
+            revert ErrorRegistryServiceNotProduct(address(product));
         }
 
-        info = _getAndVerifyContractInfo(product, PRODUCT(), owner);
+        info = _getAndVerifyContractInfo(product, PRODUCT(), initialOwner);
         info.nftId = getRegistry().register(info);
     }
 
-    function registerPool(IComponent pool, address owner)
+    function registerProductLinkedComponent(
+        IComponent component, 
+        ObjectType objectType,
+        address initialOwner
+    )
         external
-        restricted
+        virtual
+        restricted()
         returns(
             IRegistry.ObjectInfo memory info
         ) 
     {
-        if(!pool.supportsInterface(type(IPoolComponent).interfaceId)) {
-            revert NotPool();
+        // CAN revert if no ERC165 support -> will revert with empty message 
+        if(!component.supportsInterface(type(IComponent).interfaceId)) {
+            revert ErrorRegistryServiceNotComponent(address(component));
         }
 
-        info = _getAndVerifyContractInfo(pool, POOL(), owner);
-        info.nftId = getRegistry().register(info);
-    }
-
-    function registerDistribution(IComponent distribution, address owner)
-        external
-        restricted
-        returns(
-            IRegistry.ObjectInfo memory info
-        ) 
-    {
-        if(!distribution.supportsInterface(type(IDistributionComponent).interfaceId)) {
-            revert NotDistribution();
+        if (!(objectType == DISTRIBUTION() || objectType == ORACLE() || objectType == POOL())) {
+            revert ErrorRegistryServiceNotProductLinkedComponent(address(component));
         }
 
-        info = _getAndVerifyContractInfo(distribution, DISTRIBUTION(), owner);
+        info = _getAndVerifyContractInfo(component, objectType, initialOwner);
         info.nftId = getRegistry().register(info);
     }
 
     function registerDistributor(IRegistry.ObjectInfo memory info)
         external
-        restricted 
+        virtual
+        restricted()
         returns(NftId nftId) 
     {
         _verifyObjectInfo(info, DISTRIBUTOR());
@@ -139,83 +129,34 @@ contract RegistryService is
 
     function registerPolicy(IRegistry.ObjectInfo memory info)
         external
-        restricted 
+        virtual
+        restricted()
         returns(NftId nftId) 
     {
         _verifyObjectInfo(info, POLICY());
-
         nftId = getRegistry().register(info);
     }
 
     function registerBundle(IRegistry.ObjectInfo memory info)
         external
-        restricted 
+        virtual
+        restricted()
         returns(NftId nftId) 
     {
         _verifyObjectInfo(info, BUNDLE());
-
         nftId = getRegistry().register(info);
     }
 
     function registerStake(IRegistry.ObjectInfo memory info)
         external
-        restricted 
+        virtual
+        restricted()
         returns(NftId nftId) 
     {
         _verifyObjectInfo(info, STAKE());
-
         nftId = getRegistry().register(info);
     }
 
-    // from IRegisterable
-
-    function getFunctionConfigs()
-        external
-        pure
-        returns(
-            FunctionConfig[] memory config
-        )
-    {
-        config = new FunctionConfig[](8);
-
-        // order of service registrations MUST be reverse to this array 
-        /*config[-1].serviceDomain = STAKE();
-        config[-1].selector = RegistryService.registerStake.selector;*/
-
-        config[0].serviceDomain = POLICY();
-        config[0].selectors = new bytes4[](0);
-
-        config[1].serviceDomain = APPLICATION();
-        config[1].selectors = new bytes4[](1);
-        config[1].selectors[0] = RegistryService.registerPolicy.selector;
-
-        config[2].serviceDomain = CLAIM();
-        config[2].selectors = new bytes4[](0);
-
-        config[3].serviceDomain = PRODUCT();
-        config[3].selectors = new bytes4[](1);
-        config[3].selectors[0] = RegistryService.registerProduct.selector;
-
-        config[4].serviceDomain = POOL();
-        config[4].selectors = new bytes4[](1);
-        config[4].selectors[0] = RegistryService.registerPool.selector;
-
-        // registration of bundle service must preceed registration of pool service
-        config[5].serviceDomain = BUNDLE();
-        config[5].selectors = new bytes4[](1);
-        config[5].selectors[0] = RegistryService.registerBundle.selector;
-
-        config[6].serviceDomain = DISTRIBUTION();
-        config[6].selectors = new bytes4[](2);
-        config[6].selectors[0] = RegistryService.registerDistribution.selector;
-        config[6].selectors[1] = RegistryService.registerDistributor.selector;
-
-        // registerInstance() have no restriction
-        config[7].serviceDomain = INSTANCE();
-        config[7].selectors = new bytes4[](1);
-        config[7].selectors[0] = RegistryService.registerInstance.selector;
-    }
-
     // Internal
 
     function _getAndVerifyContractInfo(
@@ -224,34 +165,38 @@ contract RegistryService is
         address expectedOwner // assume can be 0 when given by other service
     )
         internal
-        // view
+        virtual
+        view
         returns(
             IRegistry.ObjectInfo memory info 
         )
     {
         info = registerable.getInitialInfo();
-        info.objectAddress = address(registerable);
+
+        if(info.objectAddress != address(registerable)) {
+            revert ErrorRegistryServiceRegisterableAddressInvalid(registerable, info.objectAddress);
+        }
 
         if(info.objectType != expectedType) {// type is checked in registry anyway...but service logic may depend on expected value
-            revert UnexpectedRegisterableType(expectedType, info.objectType);
+            revert ErrorRegistryServiceRegisterableTypeInvalid(registerable, expectedType, info.objectType);
         }
 
         address owner = info.initialOwner;
 
         if(owner != expectedOwner) { // registerable owner protection
-            revert NotRegisterableOwner(expectedOwner);
+            revert ErrorRegistryServiceRegisterableOwnerInvalid(registerable, expectedOwner, owner);
         }
 
         if(owner == address(registerable)) {
-            revert SelfRegistration();
+            revert ErrorRegistryServiceRegisterableSelfRegistration(registerable);
         }
 
         if(owner == address(0)) {
-            revert RegisterableOwnerIsZero();
+            revert ErrorRegistryServiceRegisterableOwnerZero(registerable);
         }
         
         if(getRegistry().isRegistered(owner)) { 
-            revert RegisterableOwnerIsRegistered();
+            revert ErrorRegistryServiceRegisterableOwnerRegistered(registerable, owner);
         }
     }
 
@@ -260,23 +205,37 @@ contract RegistryService is
         ObjectType expectedType
     )
         internal
+        virtual
         view
     {
-        // enforce instead of check
-        info.objectAddress = address(0);
+        if(info.objectAddress > address(0)) {
+            revert ErrorRegistryServiceObjectAddressNotZero(info.objectType);
+        }
 
         if(info.objectType != expectedType) {// type is checked in registry anyway...but service logic may depend on expected value
-            revert UnexpectedRegisterableType(expectedType, info.objectType);
+            revert ErrorRegistryServiceObjectTypeInvalid(expectedType, info.objectType);
         }
 
         address owner = info.initialOwner;
 
         if(owner == address(0)) {
-            revert RegisterableOwnerIsZero();
+            revert ErrorRegistryServiceObjectOwnerZero(info.objectType);
         }
 
-        if(getRegistry().isRegistered(owner)) { 
-            revert RegisterableOwnerIsRegistered();
+        if(owner == msg.sender) {
+            revert ErrorRegistryServiceInvalidInitialOwner(owner);
+        }
+
+        if(getRegistry().isRegistered(owner)) {
+            ObjectType ownerType = getRegistry().getObjectInfo(owner).objectType;
+            if(ownerType == REGISTRY() || ownerType == STAKING() || ownerType == SERVICE() || ownerType == INSTANCE()) {
+                revert ErrorRegistryServiceObjectOwnerRegistered(info.objectType, owner);
+            }
         }
     }
-}
+
+    // From IService
+    function _getDomain() internal override pure returns(ObjectType serviceDomain) {
+        return REGISTRY(); 
+    }
+}

package/contracts/registry/RegistryServiceManager.sol

@@ -1,53 +1,44 @@
-// SPDX-License-Identifier: UNLICENSED
+// SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {AccessManager} from "@openzeppelin/contracts/access/manager/AccessManager.sol";
-
-import {ContractDeployerLib} from "../shared/ContractDeployerLib.sol";
-
-import {Registry} from "./Registry.sol";
-import {IVersionable} from "../shared/IVersionable.sol";
-import {ProxyManager} from "../shared/ProxyManager.sol";
+import {IVersionable} from "../upgradeability/IVersionable.sol";
+import {ProxyManager} from "../upgradeability/ProxyManager.sol";
 import {RegistryService} from "./RegistryService.sol";
-import {TokenRegistry} from "./TokenRegistry.sol";
-
 
 contract RegistryServiceManager is
     ProxyManager
 {
+    error ErrorRegistryAccessManagerAuthorityZero();
+    error ErrorRegistryAccessManagerRegistryZero();
+
     bytes32 constant public ACCESS_MANAGER_CREATION_CODE_HASH = 0x0;
 
     RegistryService private immutable _registryService;
 
     /// @dev initializes proxy manager with registry service implementation and deploys registry
     constructor(
-        address initialAuthority, // used by implementation 
-        address registryAddress) // used by implementation 
-        ProxyManager(registryAddress)
+        address authority, // used by implementation 
+        address registry, // used by implementation 
+        bytes32 salt
+    ) 
     {
-        require(initialAuthority > address(0), "RegistryServiceManager: initial authority is 0");
-        require(registryAddress > address(0), "RegistryServiceManager: registry is 0");
+        if(authority == address(0)) {
+            revert ErrorRegistryAccessManagerAuthorityZero();
+        }
+
+        if(registry == address(0)) {
+            revert ErrorRegistryAccessManagerRegistryZero();
+        }
         
-        // implementation's initializer func `data` argument
-        RegistryService srv = new RegistryService();
-        bytes memory data = abi.encode(registryAddress, initialAuthority);
-        IVersionable versionable = deploy(
+        RegistryService srv = new RegistryService{ salt: salt }();
+        bytes memory data = abi.encode(authority, registry);
+        IVersionable versionable = initialize(
+            registry,
             address(srv), 
-            data);
+            data,
+            salt);
 
         _registryService = RegistryService(address(versionable));
-
-//        _linkToNftOwnable(address(_registryService));
-    }
-
-    // // from IRegisterable
-
-    // // IMPORTANT: registry here and in constructor MUST be the same
-    function linkOwnershipToServiceNft()
-        public
-        onlyOwner
-    {
-        _linkToNftOwnable(address(_registryService));
     }
 
     //--- view functions ----------------------------------------------------//

package/contracts/registry/ReleaseAdmin.sol

@@ -0,0 +1,245 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {AccessAdmin} from "../authorization/AccessAdmin.sol";
+import {AccessManagerCloneable} from "../authorization/AccessManagerCloneable.sol";
+import {IAccess} from "../authorization/IAccess.sol";
+import {IService} from "../shared/IService.sol";
+import {IServiceAuthorization} from "../authorization/IServiceAuthorization.sol";
+import {ObjectType, ObjectTypeLib, ALL} from "../type/ObjectType.sol";
+import {RoleId, RoleIdLib, ADMIN_ROLE, RELEASE_REGISTRY_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
+import {VersionPart} from "../type/Version.sol";
+
+/// @dev The ReleaseAdmin contract implements the central authorization for the services of a specific release.
+/// There is one ReleaseAdmin contract per major GIF release.
+/// Locking/unlocking of all services of a release is implemented in function setReleaseLocked.
+contract ReleaseAdmin is
+    AccessAdmin
+{
+    event LogReleaseAdminReleaseLockChanged(VersionPart release, bool locked);
+    event LogReleaseAdminServiceLockChanged(VersionPart release, address service, bool locked);
+
+    error ErrorReleaseAdminCallerNotReleaseRegistry(address caller);
+    error ErrorReleaseAdminNotService(address notService);
+    error ErrorReleaseAdminReleaseLockAlreadySetTo(bool locked);
+
+    /// @dev release core roles
+    string public constant RELEASE_REGISTRY_ROLE_NAME = "ReleaseRegistryRole";
+
+    /// @dev release core targets
+    string public constant RELEASE_ADMIN_TARGET_NAME = "ReleaseAdmin";
+
+
+    modifier onlyReleaseRegistry() {
+        (bool isMember, ) = _authority.hasRole(RELEASE_REGISTRY_ROLE().toInt(), msg.sender);
+        if(!isMember) {
+            revert ErrorReleaseAdminCallerNotReleaseRegistry(msg.sender);
+        }
+        _;
+    }
+
+    /// @dev Only used for master release admin.
+    /// Contracts created via constructor come with disabled initializers.
+    constructor() {
+        initialize(new AccessManagerCloneable());
+        _disableInitializers();
+    }
+
+    function completeSetup(
+        address registry,
+        address releaseRegistry,
+        VersionPart release
+    )
+        external
+        reinitializer(uint64(release.toInt()))
+    {
+        AccessManagerCloneable(
+            authority()).completeSetup(
+                registry, 
+                release); 
+
+        _setupReleaseRegistry(releaseRegistry);
+    }
+
+    /// @dev Sets up authorizaion for specified service.
+    /// For all authorized services its authorized functions are enabled.
+    /// Permissioned function: Access is restricted to release registry.
+    function authorizeService(
+        IServiceAuthorization serviceAuthorization,
+        IService service,
+        ObjectType serviceDomain,
+        VersionPart releaseVersion
+    )
+        external
+        restricted()
+    {
+        _createServiceTargetAndRole(service, serviceDomain, releaseVersion);
+        _authorizeServiceFunctions(serviceAuthorization, service, serviceDomain, releaseVersion);
+    }
+
+    /// @dev Locks/unlocks all release targets.
+    /// For all authorized services of release its authorized functions are disabled/enabled.
+    /// Permissioned function: Access is restricted to release registry.
+    /// Note: onlyReleaseRegistry() modifier is used to prevent dead lock.
+    function setReleaseLocked(bool locked)
+        external
+        onlyReleaseRegistry()
+    {
+        // checks
+        AccessManagerCloneable accessManager = AccessManagerCloneable(authority());
+        if(accessManager.isLocked() == locked) {
+            revert ErrorReleaseAdminReleaseLockAlreadySetTo(locked);
+        }
+
+        // effects
+        accessManager.setLocked(locked);
+
+        emit LogReleaseAdminReleaseLockChanged(getRelease(), locked);
+    }
+
+    /// @dev Lock/unlock specific service of release.
+    /// Permissioned function: Access is restricted to release registry.
+    function setServiceLocked(IService service, bool locked)
+        external
+        restricted()
+    {
+        // assume all targets except release admin are services
+        // ensure release admin can not be locked
+        if(address(service) == address(this)) {
+            revert ErrorReleaseAdminNotService(address(service));
+        }
+
+        _setTargetClosed(address(service), locked);
+
+        emit LogReleaseAdminServiceLockChanged(service.getRelease(), address(service), locked);
+    }
+
+    //--- view functions ----------------------------------------------------//
+
+/*
+    function getReleaseAdminRole() external view returns (RoleId) {
+        return GIF_ADMIN_ROLE();
+    }
+*/
+    //--- private functions -------------------------------------------------//
+
+    function _createServiceTargetAndRole(
+        IService service, 
+        ObjectType serviceDomain, 
+        VersionPart releaseVersion
+    )
+        private
+    {
+        string memory baseName = ObjectTypeLib.toName(serviceDomain);
+        uint256 versionInt = releaseVersion.toInt();
+
+        // create service target
+        string memory serviceTargetName = ObjectTypeLib.toVersionedName(
+            baseName, "Service", versionInt);
+
+        _createTarget(
+            address(service), 
+            serviceTargetName,
+            true,
+            false);
+
+        // create service role
+        RoleId serviceRoleId = RoleIdLib.roleForTypeAndVersion(
+            serviceDomain, 
+            releaseVersion);
+
+        if(!roleExists(serviceRoleId)) {
+            _createRole(
+                serviceRoleId, 
+                toRole({
+                    adminRoleId: ADMIN_ROLE(),
+                    roleType: RoleType.Contract,
+                    maxMemberCount: 1,
+                    name: ObjectTypeLib.toVersionedName(
+                        baseName, 
+                        "ServiceRole", 
+                        versionInt)}));
+        }
+
+        _grantRoleToAccount( 
+            serviceRoleId,
+            address(service)); 
+    }
+
+
+    function _authorizeServiceFunctions(
+        IServiceAuthorization serviceAuthorization,
+        IService service,
+        ObjectType serviceDomain, 
+        VersionPart releaseVersion
+    )
+        private
+    {
+        ObjectType authorizedDomain;
+        RoleId authorizedRoleId;
+
+        ObjectType[] memory authorizedDomains = serviceAuthorization.getAuthorizedDomains(serviceDomain);
+
+        for (uint256 i = 0; i < authorizedDomains.length; i++) {
+            authorizedDomain = authorizedDomains[i];
+
+            // derive authorized role from authorized domain
+            if (authorizedDomain == ALL()) {
+                authorizedRoleId = PUBLIC_ROLE();
+            } else {
+                authorizedRoleId = RoleIdLib.roleForTypeAndVersion(
+                authorizedDomain, 
+                releaseVersion);
+            }
+
+            if(!roleExists(authorizedRoleId)) {
+                // create role for authorized domain
+                _createRole(
+                    authorizedRoleId, 
+                    toRole({
+                        adminRoleId: ADMIN_ROLE(),
+                        roleType: RoleType.Contract,
+                        maxMemberCount: 1,
+                        name: ObjectTypeLib.toVersionedName(
+                            ObjectTypeLib.toName(authorizedDomain), 
+                            "Role", 
+                            releaseVersion.toInt())}));
+            }
+
+            // get authorized functions for authorized domain
+            IAccess.FunctionInfo[] memory authorizatedFunctions = serviceAuthorization.getAuthorizedFunctions(
+                serviceDomain, 
+                authorizedDomain);
+
+            _authorizeTargetFunctions(
+                    address(service), 
+                    authorizedRoleId, 
+                    authorizatedFunctions);
+        }
+    }
+
+    //--- private initialization functions -------------------------------------------//
+
+    function _setupReleaseRegistry(address releaseRegistry)
+        private 
+        onlyInitializing()
+    {
+        _createTarget(address(this), RELEASE_ADMIN_TARGET_NAME, false, false);
+
+        _createRole(
+            RELEASE_REGISTRY_ROLE(), 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: 1,
+                name: RELEASE_REGISTRY_ROLE_NAME}));
+
+        FunctionInfo[] memory functions;
+        functions = new FunctionInfo[](2);
+        functions[0] = toFunction(ReleaseAdmin.authorizeService.selector, "authorizeService");
+        functions[1] = toFunction(ReleaseAdmin.setServiceLocked.selector, "setServiceLocked");
+        _authorizeTargetFunctions(address(this), RELEASE_REGISTRY_ROLE(), functions);
+
+        _grantRoleToAccount(RELEASE_REGISTRY_ROLE(), releaseRegistry);
+    }
+}