@etherisc/gif-next 0.0.2-b28f7c7-340 → 0.0.2-b44ae3c-205

package/contracts/instance/IInstanceService.sol

@@ -5,16 +5,13 @@ import {NftId} from "../types/NftId.sol";
 import {ObjectType} from "../types/ObjectType.sol";
 import {RoleId} from "../types/RoleId.sol";
 import {IService} from "../shared/IService.sol";
-import {IRegistry} from "../registry/IRegistry.sol";
 
-import {IRegisterable} from "../shared/IRegisterable.sol";
-import {IComponent} from "../components/IComponent.sol";
-
-import {AccessManagerUpgradeableInitializeable} from "./AccessManagerUpgradeableInitializeable.sol";
+import {AccessManagerUpgradeableInitializeable} from "../shared/AccessManagerUpgradeableInitializeable.sol";
 import {InstanceAccessManager} from "./InstanceAccessManager.sol";
 import {Instance} from "./Instance.sol";
 import {InstanceReader} from "./InstanceReader.sol";
 import {BundleManager} from "./BundleManager.sol";
+import {InstanceStore} from "./InstanceStore.sol";
 
 interface IInstanceService is IService {
 
@@ -29,15 +26,16 @@ interface IInstanceService is IService {
     error ErrorInstanceServiceInstanceReaderSameAsMasterInstanceReader();
     error ErrorInstanceServiceInstanceReaderInstanceMismatch();
 
-    error ErrorInstanceServiceOzAccessManagerZero();
     error ErrorInstanceServiceInstanceAccessManagerZero();
     error ErrorInstanceServiceInstanceReaderZero();
     error ErrorInstanceServiceBundleManagerZero();
+    error ErrorInstanceServiceInstanceStoreZero();
 
     error ErrorInstanceServiceInstanceAuthorityMismatch();
     error ErrorInstanceServiceBundleManagerAuthorityMismatch();
     error ErrorInstanceServiceInstanceReaderInstanceMismatch2();
     error ErrorInstanceServiceBundleMangerInstanceMismatch();
+    error ErrorInstanceServiceInstanceStoreAuthorityMismatch();
 
     error ErrorInstanceServiceRequestUnauhorized(address caller);
     error ErrorInstanceServiceNotInstanceOwner(address caller, NftId instanceNftId);
@@ -46,17 +44,21 @@ interface IInstanceService is IService {
     error ErrorInstanceServiceInstanceComponentMismatch(NftId instanceNftId, NftId componentNftId);
     error ErrorInstanceServiceInvalidComponentType(address componentAddress, ObjectType expectedType, ObjectType componentType);
     
-    event LogInstanceCloned(address clonedOzAccessManager, address clonedInstanceAccessManager, address clonedInstance, address clonedBundleManager, address clonedInstanceReader, NftId clonedInstanceNftId);
+    event LogInstanceCloned(
+        address clonedOzAccessManager,
+        address clonedInstanceAccessManager,
+        address clonedInstance,
+        address clonedInstanceStore,
+        address clonedBundleManager, 
+        address clonedInstanceReader, 
+        NftId clonedInstanceNftId
+    );
 
     function createInstanceClone()
         external 
         returns (
-            AccessManagerUpgradeableInitializeable clonedOzAccessManager,
-            InstanceAccessManager clonedInstanceAccessManager, 
             Instance clonedInstance,
-            NftId instanceNftId,
-            InstanceReader clonedInstanceReader,
-            BundleManager clonedBundleManager
+            NftId instanceNftId
         );
 
     function createGifTarget(
@@ -68,5 +70,4 @@ interface IInstanceService is IService {
     ) external;
 
     function setComponentLocked(bool locked) external;
-}
-
+}

package/contracts/instance/Instance.sol

@@ -3,19 +3,19 @@ pragma solidity ^0.8.20;
 
 import {AccessManagedUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagedUpgradeable.sol";
 
-import {Key32, KeyId, Key32Lib} from "../types/Key32.sol";
+import {Key32} from "../types/Key32.sol";
 import {NftId} from "../types/NftId.sol";
-import {ClaimId} from "../types/ClaimId.sol";
-import {NumberId} from "../types/NumberId.sol";
+import {RiskId} from "../types/RiskId.sol";
 import {ObjectType, BUNDLE, DISTRIBUTION, INSTANCE, POLICY, POOL, ROLE, PRODUCT, TARGET, COMPONENT, DISTRIBUTOR, DISTRIBUTOR_TYPE} from "../types/ObjectType.sol";
-import {RiskId, RiskIdLib} from "../types/RiskId.sol";
-import {RoleId, RoleIdLib, INSTANCE_ROLE, INSTANCE_OWNER_ROLE} from "../types/RoleId.sol";
-import {StateId, ACTIVE} from "../types/StateId.sol";
-import {TimestampLib} from "../types/Timestamp.sol";
+import {RoleId, RoleIdLib, eqRoleId, ADMIN_ROLE, INSTANCE_ROLE, INSTANCE_OWNER_ROLE} from "../types/RoleId.sol";
 import {VersionPart, VersionPartLib} from "../types/Version.sol";
+import {ClaimId} from "../types/ClaimId.sol";
+import {ReferralId} from "../types/Referral.sol";
+import {PayoutId} from "../types/PayoutId.sol";
+import {DistributorType} from "../types/DistributorType.sol";
 
-import {ERC165} from "../shared/ERC165.sol";
 import {Registerable} from "../shared/Registerable.sol";
+import {TokenHandler} from "../shared/TokenHandler.sol";
 
 import {IRegistry} from "../registry/IRegistry.sol";
 
@@ -23,10 +23,10 @@ import {IInstance} from "./IInstance.sol";
 import {InstanceReader} from "./InstanceReader.sol";
 import {InstanceAccessManager} from "./InstanceAccessManager.sol";
 import {BundleManager} from "./BundleManager.sol";
+import {InstanceStore} from "./InstanceStore.sol";
 
 import {KeyValueStore} from "./base/KeyValueStore.sol";
 
-import {IAccess} from "./module/IAccess.sol";
 import {IBundle} from "./module/IBundle.sol";
 import {IComponents} from "./module/IComponents.sol";
 import {IDistribution} from "./module/IDistribution.sol";
@@ -39,29 +39,20 @@ import {IPoolService} from "./service/IPoolService.sol";
 import {IProductService} from "./service/IProductService.sol";
 import {IPolicyService} from "./service/IPolicyService.sol";
 import {IBundleService} from "./service/IBundleService.sol";
-import {TokenHandler} from "../shared/TokenHandler.sol";
-import {VersionPart, VersionPartLib} from "../types/Version.sol";
 
 contract Instance is
     IInstance,
     AccessManagedUpgradeable,
-    Registerable,
-    KeyValueStore
+    Registerable
 {
-
     uint256 public constant GIF_MAJOR_VERSION = 3;
 
-    uint64 public constant ADMIN_ROLE = type(uint64).min;
-    uint64 public constant PUBLIC_ROLE = type(uint64).max;
-    uint64 public constant CUSTOM_ROLE_ID_MIN = 10000;
-
-    uint32 public constant EXECUTION_DELAY = 0;
-
     bool private _initialized;
 
     InstanceAccessManager internal _accessManager;
     InstanceReader internal _instanceReader;
     BundleManager internal _bundleManager;
+    InstanceStore internal _instanceStore;
 
     modifier onlyChainNft() {
         if(msg.sender != getRegistry().getChainNftAddress()) {
@@ -71,206 +62,149 @@ contract Instance is
     }
 
     function initialize(address authority, address registryAddress, address initialOwner) 
-        public 
+        external 
         initializer()
     {
+        if(authority == address(0)) {
+            revert ErrorInstanceInstanceAccessManagerZero();
+        }
+
         __AccessManaged_init(authority);
         
         IRegistry registry = IRegistry(registryAddress);
         initializeRegisterable(registryAddress, registry.getNftId(), INSTANCE(), true, initialOwner, "");
-        initializeLifecycle();
 
         registerInterface(type(IInstance).interfaceId);    
     }
 
-    //--- ProductSetup ------------------------------------------------------//
-    function createProductSetup(NftId productNftId, ISetup.ProductSetupInfo memory setup) external restricted() {
-        create(_toNftKey32(productNftId, PRODUCT()), abi.encode(setup));
-    }
-
-    function updateProductSetup(NftId productNftId, ISetup.ProductSetupInfo memory setup, StateId newState) external restricted() {
-        update(_toNftKey32(productNftId, PRODUCT()), abi.encode(setup), newState);
-    }
-
-    function updateProductSetupState(NftId productNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(productNftId, PRODUCT()), newState);
-    }
-
-    //--- DistributionSetup ------------------------------------------------------//
-    function createDistributionSetup(NftId distributionNftId, ISetup.DistributionSetupInfo memory setup) external restricted() {
-        create(_toNftKey32(distributionNftId, DISTRIBUTION()), abi.encode(setup));
-    }
-
-    function updateDistributionSetup(NftId distributionNftId, ISetup.DistributionSetupInfo memory setup, StateId newState) external restricted() {
-        update(_toNftKey32(distributionNftId, DISTRIBUTION()), abi.encode(setup), newState);
-    }
-
-    function updateDistributionSetupState(NftId distributionNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(distributionNftId, DISTRIBUTION()), newState);
-    }
-
-    //--- PoolSetup ------------------------------------------------------//
-    function createPoolSetup(NftId poolNftId, IComponents.ComponentInfo memory info) external restricted() {
-        create(_toNftKey32(poolNftId, POOL()), abi.encode(info));
-    }
-
-    function updatePoolSetup(NftId poolNftId, IComponents.ComponentInfo memory info, StateId newState) external restricted() {
-        update(_toNftKey32(poolNftId, POOL()), abi.encode(info), newState);
-    }
-
-    function updatePoolSetupState(NftId poolNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(poolNftId, POOL()), newState);
-    }
-
-    //--- DistributorType -------------------------------------------------------//
-    function createDistributorType(Key32 distributorKey, IDistribution.DistributorTypeInfo memory info) external restricted() {
-        create(distributorKey, abi.encode(info));
-    }
-
-    function updateDistributorType(Key32 distributorKey, IDistribution.DistributorTypeInfo memory info, StateId newState) external restricted() {
-        update(distributorKey, abi.encode(info), newState);
-    }
-
-    function updateDistributorTypeState(Key32 distributorKey, StateId newState) external restricted() {
-        updateState(distributorKey, newState);
-    }
+    //--- Roles ------------------------------------------------------------//
 
-    //--- Distributor -------------------------------------------------------//
-    function createDistributor(NftId nftId, IDistribution.DistributorInfo memory info) external restricted() {
-        create(toDistributorKey32(nftId), abi.encode(info));
-    }
-
-    function updateDistributor(NftId nftId, IDistribution.DistributorInfo memory info, StateId newState) external restricted() {
-        update(toDistributorKey32(nftId), abi.encode(info), newState);
-    }
-
-    function updateDistributorState(NftId nftId, StateId newState) external restricted() {
-        updateState(toDistributorKey32(nftId), newState);
-    }
-
-    //--- Referral ----------------------------------------------------------//
-    function createReferral(Key32 referralKey, IDistribution.ReferralInfo memory referralInfo) external restricted() {
-        create(referralKey, abi.encode(referralInfo));
-    }
-
-    function updateReferral(Key32 referralKey, IDistribution.ReferralInfo memory referralInfo, StateId newState) external restricted() {
-        update(referralKey, abi.encode(referralInfo), newState);
-    }
-
-    function updateReferralState(Key32 referralKey, StateId newState) external restricted() {
-        updateState(referralKey, newState);
-    }
-
-    //--- Bundle ------------------------------------------------------------//
-    function createBundle(NftId bundleNftId, IBundle.BundleInfo memory bundle) external restricted() {
-        create(toBundleKey32(bundleNftId), abi.encode(bundle));
-    }
-
-    function updateBundle(NftId bundleNftId, IBundle.BundleInfo memory bundle, StateId newState) external restricted() {
-        update(toBundleKey32(bundleNftId), abi.encode(bundle), newState);
-    }
-
-    function updateBundleState(NftId bundleNftId, StateId newState) external restricted() {
-        updateState(toBundleKey32(bundleNftId), newState);
+    function createRole(string memory roleName, string memory adminName)
+        external
+        restricted // INSTANCE_OWNER_ROLE
+        returns (RoleId roleId, RoleId admin)
+    {
+        (roleId, admin) = _accessManager.createRole(roleName, adminName);
     }
 
-    //--- Risk --------------------------------------------------------------//
-    function createRisk(RiskId riskId, IRisk.RiskInfo memory risk) external restricted() {
-        create(riskId.toKey32(), abi.encode(risk));
+    function grantRole(RoleId roleId, address account) 
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.grantRole(roleId, account);
     }
 
-    function updateRisk(RiskId riskId, IRisk.RiskInfo memory risk, StateId newState) external restricted() {
-        update(riskId.toKey32(), abi.encode(risk), newState);
+    function revokeRole(RoleId roleId, address account) 
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.revokeRole(roleId, account);
     }
 
-    function updateRiskState(RiskId riskId, StateId newState) external restricted() {
-        updateState(riskId.toKey32(), newState);
-    }
+    //--- Targets ------------------------------------------------------------//
 
-    //--- Application (Policy) ----------------------------------------------//
-    function createApplication(NftId applicationNftId, IPolicy.PolicyInfo memory policy) external restricted() {
-        create(toPolicyKey32(applicationNftId), abi.encode(policy));
+    function createTarget(address target, string memory name) 
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.createTarget(target, name);
     }
 
-    function updateApplication(NftId applicationNftId, IPolicy.PolicyInfo memory policy, StateId newState) external restricted() {
-        update(toPolicyKey32(applicationNftId), abi.encode(policy), newState);
+    function setTargetFunctionRole(
+        string memory targetName,
+        bytes4[] calldata selectors,
+        RoleId roleId
+    ) 
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.setTargetFunctionRole(targetName, selectors, roleId);
     }
 
-    function updateApplicationState(NftId applicationNftId, StateId newState) external restricted() {
-        updateState(toPolicyKey32(applicationNftId), newState);
+    function setTargetLocked(address target, bool locked)
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.setTargetLockedByInstance(target, locked);
     }
 
-    //--- Policy ------------------------------------------------------------//
-    function updatePolicy(NftId policyNftId, IPolicy.PolicyInfo memory policy, StateId newState) external restricted() {
-        update(toPolicyKey32(policyNftId), abi.encode(policy), newState);
-    }
+    //--- ITransferInterceptor ------------------------------------------------------------//
 
-    function updatePolicyState(NftId policyNftId, StateId newState) external restricted() {
-        updateState(toPolicyKey32(policyNftId), newState);
+    function nftMint(address to, uint256 tokenId) external onlyChainNft {
+        assert(_accessManager.roleMembers(INSTANCE_OWNER_ROLE()) == 0);// temp
+        assert(_accessManager.grantRole(INSTANCE_OWNER_ROLE(), to) == true);
     }
 
-    //--- Claim -------------------------------------------------------------//
-    function createClaim(NftId policyNftId, ClaimId claimId, IPolicy.ClaimInfo memory claim) external restricted() {
-        create(toPolicyKey32(policyNftId), abi.encode(claim));
+    function nftTransferFrom(address from, address to, uint256 tokenId) external onlyChainNft {
+        assert(_accessManager.revokeRole(INSTANCE_OWNER_ROLE(), from) == true);
+        assert(_accessManager.grantRole(INSTANCE_OWNER_ROLE(), to) == true);
     }
 
-    function updateClaim(NftId policyNftId, ClaimId claimId, IPolicy.ClaimInfo memory claim, StateId newState) external restricted() {
-        update(toPolicyKey32(policyNftId), abi.encode(claim), newState);
-    }
+    //--- initial setup functions -------------------------------------------//
 
-    function updateClaimState(NftId policyNftId, ClaimId claimId, StateId newState) external restricted() {
-        updateState(toPolicyKey32(policyNftId), newState);
+    function setInstanceAccessManager(InstanceAccessManager accessManager) external restricted {
+        if(address(_accessManager) != address(0)) {
+            revert ErrorInstanceInstanceAccessManagerAlreadySet(address(_accessManager));
+        }
+        if(accessManager.authority() != authority()) {
+            revert ErrorInstanceInstanceAccessManagerAuthorityMismatch(authority());
+        }
+        _accessManager = accessManager;      
     }
-
-    //--- Payout ------------------------------------------------------------//
-    function createPayout(NftId policyNftId, NumberId payoutId, IPolicy.PayoutInfo memory payout) external restricted() {
-        create(toPolicyKey32(policyNftId), abi.encode(payout));
+    
+    function setBundleManager(BundleManager bundleManager) external restricted() {
+        if(address(_bundleManager) != address(0)) {
+            revert ErrorInstanceBundleManagerAlreadySet(address(_bundleManager));
+        }
+        if(bundleManager.getInstance() != Instance(this)) {
+            revert ErrorInstanceBundleManagerInstanceMismatch(address(this));
+        }
+        if(bundleManager.authority() != authority()) {
+            revert ErrorInstanceBundleManagerAuthorityMismatch(authority());
+        }
+        _bundleManager = bundleManager;
     }
 
-    function updatePayout(NftId policyNftId, NumberId payoutId, IPolicy.PayoutInfo memory payout, StateId newState) external restricted() {
-        update(toPolicyKey32(policyNftId), abi.encode(payout), newState);
-    }
+    function setInstanceReader(InstanceReader instanceReader) external restricted() {
+        if(instanceReader.getInstance() != Instance(this)) {
+            revert ErrorInstanceInstanceReaderInstanceMismatch(address(this));
+        }
 
-    function updatePayoutState(NftId policyNftId, StateId newState) external restricted() {
-        updateState(toPolicyKey32(policyNftId), newState);
+        _instanceReader = instanceReader;
     }
 
-    //--- ITransferInterceptor ------------------------------------------------------------//
-    function nftMint(address to, uint256 tokenId) external onlyChainNft {
-        assert(_accessManager.roleMembers(INSTANCE_OWNER_ROLE()) == 0);// temp
-        assert(_accessManager.grantRole(INSTANCE_OWNER_ROLE(), to) == true);
-    }
+    //--- external view functions -------------------------------------------//
 
-    function nftTransferFrom(address from, address to, uint256 tokenId) external onlyChainNft {
-        assert(_accessManager.revokeRole(INSTANCE_OWNER_ROLE(), from) == true);
-        assert(_accessManager.grantRole(INSTANCE_OWNER_ROLE(), to) == true);
+    function getInstanceReader() external view returns (InstanceReader) {
+        return _instanceReader;
     }
 
-    //--- internal view/pure functions --------------------------------------//
-    function _toNftKey32(NftId nftId, ObjectType objectType) internal pure returns (Key32) {
-        return nftId.toKey32(objectType);
+    function getBundleManager() external view returns (BundleManager) {
+        return _bundleManager;
     }
 
-    function toBundleKey32(NftId bundleNftId) public pure returns (Key32) {
-        return bundleNftId.toKey32(BUNDLE());
+    function getInstanceAccessManager() external view returns (InstanceAccessManager) {
+        return _accessManager;
     }
 
-    function toPolicyKey32(NftId policyNftId) public pure returns (Key32) {
-        return policyNftId.toKey32(POLICY());
+    function setInstanceStore(InstanceStore instanceStore) external restricted {
+        if(address(_instanceStore) != address(0)) {
+            revert ErrorInstanceInstanceStoreAlreadySet(address(_instanceStore));
+        }
+        if(instanceStore.authority() != authority()) {
+            revert ErrorInstanceInstanceStoreAuthorityMismatch(authority());
+        }
+        _instanceStore = instanceStore;
     }
 
-    function toDistributionKey32(NftId distNftId) public pure returns (Key32) {
-        return distNftId.toKey32(DISTRIBUTION());
+    function getInstanceStore() external view returns (InstanceStore) {
+        return _instanceStore;
     }
 
-    function toDistributorTypeKey32(NftId distNftId) public pure returns (Key32) {
-        return distNftId.toKey32(DISTRIBUTOR_TYPE());
+    function getMajorVersion() external pure returns (VersionPart majorVersion) {
+        return VersionPartLib.toVersionPart(GIF_MAJOR_VERSION);
     }
 
-    function toDistributorKey32(NftId distNftId) public pure returns (Key32) {
-        return distNftId.toKey32(DISTRIBUTOR());
-    }
-    
     function getDistributionService() external view returns (IDistributionService) {
         return IDistributionService(getRegistry().getServiceAddress(DISTRIBUTION(), VersionPart.wrap(3)));
     }
@@ -291,37 +225,5 @@ contract Instance is
         return IBundleService(getRegistry().getServiceAddress(BUNDLE(), VersionPart.wrap(3)));
     }
 
-    function setInstanceReader(InstanceReader instanceReader) external restricted() {
-        require(instanceReader.getInstance() == Instance(this), "InstanceReader instance mismatch");
-        _instanceReader = instanceReader;
-    }
-
-    function getMajorVersion() external pure returns (VersionPart majorVersion) {
-        return VersionPartLib.toVersionPart(GIF_MAJOR_VERSION);
-    }
-
-    function getInstanceReader() external view returns (InstanceReader) {
-        return _instanceReader;
-    }
-    
-    function setBundleManager(BundleManager bundleManager) external restricted() {
-        require(address(_bundleManager) == address(0), "BundleManager is set");
-        require(bundleManager.getInstance() == Instance(this), "BundleManager instance mismatch");
-        require(bundleManager.authority() == authority(), "BundleManager authority mismatch");
-        _bundleManager = bundleManager;
-    }
-
-    function getBundleManager() external view returns (BundleManager) {
-        return _bundleManager;
-    }
-
-    function setInstanceAccessManager(InstanceAccessManager accessManager) external restricted {
-        require(address(_accessManager) == address(0), "InstanceAccessManager is set");
-        require(accessManager.authority() == authority(), "InstanceAccessManager authority mismatch");  
-        _accessManager = accessManager;      
-    }
-
-    function getInstanceAccessManager() external view returns (InstanceAccessManager) {
-        return _accessManager;
-    }
-}
+    //--- internal view/pure functions --------------------------------------//
+}

package/contracts/instance/InstanceAccessManager.sol

@@ -9,7 +9,7 @@ import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE, INSTANCE_SERVICE_ROLE, INSTA
 import {TimestampLib} from "../types/Timestamp.sol";
 import {NftId} from "../types/NftId.sol";
 
-import {AccessManagerUpgradeableInitializeable} from "./AccessManagerUpgradeableInitializeable.sol";
+import {AccessManagerUpgradeableInitializeable} from "../shared/AccessManagerUpgradeableInitializeable.sol";
 
 import {IRegistry} from "../registry/IRegistry.sol";
 
@@ -73,7 +73,7 @@ contract InstanceAccessManager is
         _createRole(ADMIN_ROLE(), ADMIN_ROLE_NAME, IAccess.Type.Core);
         _createRole(PUBLIC_ROLE(), PUBLIC_ROLE_NAME, IAccess.Type.Core);
         _createRole(INSTANCE_ROLE(), INSTANCE_ROLE_NAME, IAccess.Type.Core);
-        _createRole(INSTANCE_OWNER_ROLE(), INSTANCE_OWNER_ROLE_NAME, IAccess.Type.Gif);
+        _createRole(INSTANCE_OWNER_ROLE(), INSTANCE_OWNER_ROLE_NAME, IAccess.Type.Gif);// TODO should be of core type
 
         // assume `this` is already a member of ADMIN_ROLE
         EnumerableSet.add(_roleMembers[ADMIN_ROLE()], address(this));
@@ -105,6 +105,7 @@ contract InstanceAccessManager is
     }
 
     // INSTANCE_OWNER_ROLE
+    // TODO specify how many owners role can have -> many roles MUST have exactly 1 member?
     function createRole(string memory roleName, string memory adminName)
         external
         restricted()
@@ -142,6 +143,7 @@ contract InstanceAccessManager is
         _roleInfo[roleId].admin = admin;      
     }
 
+    // TODO core role can be granted only to 1 member
     function grantRole(RoleId roleId, address member) 
         public
         restrictedToRoleAdmin(roleId) 
@@ -226,7 +228,7 @@ contract InstanceAccessManager is
         return _roleIds[idx];
     }
 
-    // TODO now: for non existent name returns ADMIN_ROLE id
+    // TODO returns ADMIN_ROLE id for non existent name
     function getRoleIdForName(string memory name) external view returns (RoleId roleId) {
         return _roleIdForName[ShortStrings.toShortString(name)];
     }
@@ -250,7 +252,7 @@ contract InstanceAccessManager is
         _createTarget(target, name, IAccess.Type.Core);
     }
     // INSTANCE_SERVICE_ROLE
-    // assume gif target is registered and belongs to the same instance as instance access manager
+    // TODO check for instance mismatch?
     function createGifTarget(address target, string memory name) external restricted() 
     {
         if(!_registry.isRegistered(target)) {
@@ -269,26 +271,22 @@ contract InstanceAccessManager is
         _createTarget(target, name, IAccess.Type.Custom);
     }
 
-    // INSTANCE_SERVICE_ROLE
-    // IMPORTANT: instance access manager MUST be of Core type -> otherwise will be locked forever
-    function setTargetLocked(address target, bool locked) 
+    // TODO instance owner locks component instead of revoking it access to the instance...
+    function setTargetLockedByService(address target, bool locked)
         external 
-        restricted() 
+        restricted // INSTANCE_SERVICE_ROLE
     {
-        IAccess.Type targetType = _targetInfo[target].ttype;
-        if(target == address(0) || targetType == IAccess.Type.NotInitialized) {
-            revert IAccess.ErrorIAccessTargetDoesNotExist(target);
-        }
-
-        if(targetType == IAccess.Type.Core) {
-            revert IAccess.ErrorIAccessTargetTypeInvalid(target, targetType);
-        }
+        _setTargetLocked(target, locked);
+    }
 
-        // TODO isLocked is redundant but makes getTargetInfo() faster
-        _targetInfo[target].isLocked = locked;
-        _accessManager.setTargetClosed(target, locked);
+    function setTargetLockedByInstance(address target, bool locked)
+        external
+        restricted // INSTANCE_ROLE
+    {
+        _setTargetLocked(target, locked);
     }
 
+
     // allowed combinations of roles and targets:
     //1) set core role for core target 
     //2) set gif role for gif target  
@@ -362,7 +360,7 @@ contract InstanceAccessManager is
     }
 
     function isTargetLocked(address target) public view returns (bool locked) {
-        return _accessManager.isTargetClosed(target);
+        return _targetInfo[target].isLocked;
     }
 
     function targetExists(address target) public view returns (bool exists) {
@@ -497,6 +495,22 @@ contract InstanceAccessManager is
         }
     }
 
+    // IMPORTANT: instance access manager MUST be of Core type -> otherwise can be locked forever
+    function _setTargetLocked(address target, bool locked) internal
+    {
+        IAccess.Type targetType = _targetInfo[target].ttype;
+        if(target == address(0) || targetType == IAccess.Type.NotInitialized) {
+            revert IAccess.ErrorIAccessTargetDoesNotExist(target);
+        }
+
+        if(targetType == IAccess.Type.Core) {
+            revert IAccess.ErrorIAccessTargetTypeInvalid(target, targetType);
+        }
+
+        _targetInfo[target].isLocked = locked;
+        _accessManager.setTargetClosed(target, locked);
+    }
+
     function _setTargetFunctionRole(
         address target,
         ShortString name,
@@ -524,4 +538,4 @@ contract InstanceAccessManager is
     ) public view virtual returns (bool immediate, uint32 delay) {
         return _accessManager.canCall(caller, target, selector);
     }
-}
+}