@etherisc/gif-next 0.0.2-bb3faee-097 → 0.0.2-bb9ecaf-723

package/contracts/instance/InstanceAdmin.sol

@@ -3,7 +3,6 @@ pragma solidity ^0.8.20;
 
 import {IAccess} from "../authorization/IAccess.sol";
 import {IAuthorization} from "../authorization/IAuthorization.sol";
-import {IInstanceLinkedComponent} from "../shared/IInstanceLinkedComponent.sol";
 import {IRegistry} from "../registry/IRegistry.sol";
 import {IInstance} from "./IInstance.sol";
 
@@ -14,17 +13,12 @@ import {ObjectType, INSTANCE} from "../type/ObjectType.sol";
 import {RoleId, ADMIN_ROLE} from "../type/RoleId.sol";
 import {Str} from "../type/String.sol";
 import {VersionPart} from "../type/Version.sol";
+import {INSTANCE_TARGET_NAME, INSTANCE_ADMIN_TARGET_NAME, INSTANCE_STORE_TARGET_NAME, PRODUCT_STORE_TARGET_NAME, BUNDLE_SET_TARGET_NAME, RISK_SET_TARGET_NAME} from "./TargetNames.sol";
 
 
 contract InstanceAdmin is
     AccessAdmin
 {
-    string public constant INSTANCE_TARGET_NAME = "Instance";
-    string public constant INSTANCE_ADMIN_TARGET_NAME = "InstanceAdmin";
-    string public constant INSTANCE_STORE_TARGET_NAME = "InstanceStore";
-    string public constant BUNDLE_SET_TARGET_NAME = "BundleSet";
-    string public constant RISK_SET_TARGET_NAME = "RiskSet";
-
     // onlyInstanceService
     error ErrorInstanceAdminNotInstanceService(address caller);
 
@@ -33,13 +27,9 @@ contract InstanceAdmin is
 
     IInstance internal _instance;
     IRegistry internal _registry;
-    VersionPart internal _release;
 
     uint64 internal _customRoleIdNext;
 
-    mapping(address target => RoleId roleId) internal _targetRoleId;
-    uint64 internal _components;
-
 
     modifier onlyInstanceService() {
         if (msg.sender != _registry.getServiceAddress(INSTANCE(), getRelease())) {
@@ -48,6 +38,7 @@ contract InstanceAdmin is
         _;
     }
 
+
     /// @dev Only used for master instance admin.
     constructor(address accessManager) {
         initialize(
@@ -67,45 +58,46 @@ contract InstanceAdmin is
     )
         external
         reinitializer(uint64(release.toInt()))
-        onlyDeployer()
     {
         // checks
         AccessAdminLib.checkIsRegistered(registry, instance, INSTANCE());
 
+        // effects
         AccessManagerCloneable(
             authority()).completeSetup(
                 registry, 
                 release); 
 
-        _checkAuthorization(authorization, INSTANCE(), release, false, true);
+        AccessAdminLib.checkAuthorization(
+            address(_authorization), 
+            authorization, 
+            INSTANCE(), // expectedDomain
+            release, // expectedRelease
+            false, // expectServiceAuthorization
+            true); // checkAlreadyInitialized
 
-        // effects
         _registry = IRegistry(registry);
-        _release = release;
-
         _instance = IInstance(instance);
         _authorization = IAuthorization(authorization);
-        _components = 0;
         _customRoleIdNext = 0;
 
         // link nft ownability to instance
         _linkToNftOwnable(instance);
 
+        // setup roles and services
+        _createRoles(_authorization);
+        _setupServices(_authorization);
+
         // setup instance targets
         _createInstanceTargets(_authorization.getMainTargetName());
 
-        // setup non-contract roles
-        _setupServiceRoles(_authorization);
-        _createRoles(_authorization);
-
         // authorize functions of instance contracts
         _createTargetAuthorizations(_authorization);
     }
 
-
     /// @dev grants the service roles to the service addresses based on the authorization specification.
     /// Service addresses used for the granting are determined by the registry and the release of this instance.
-    function _setupServiceRoles(IAuthorization authorization)
+    function _setupServices(IAuthorization authorization)
         internal
     {
         ObjectType[] memory serviceDomains = authorization.getServiceDomains();
@@ -113,21 +105,8 @@ contract InstanceAdmin is
         for(uint256 i = 0; i < serviceDomains.length; i++) {
             ObjectType serviceDomain = serviceDomains[i];
             RoleId serviceRoleId = authorization.getServiceRole(serviceDomain);
-            string memory serviceRoleName = authorization.getRoleName(serviceRoleId);
-
-            // create service role if missing
-            if (!roleExists(serviceRoleId)) {
-                _createRole(
-                    serviceRoleId, 
-                    AccessAdminLib.toRole(
-                        ADMIN_ROLE(), 
-                        IAccess.RoleType.Contract, 
-                        1, 
-                        serviceRoleName));
-            }
+            address service = _registry.getServiceAddress(serviceDomain, getRelease());
 
-            // grant service role to service
-            address service = _registry.getServiceAddress(serviceDomain, _release);
             _grantRoleToAccount(
                 serviceRoleId,
                 service);
@@ -138,11 +117,17 @@ contract InstanceAdmin is
     function _createInstanceTargets(string memory instanceTargetName)
         internal
     {
-        _createManagedTarget(address(_instance), instanceTargetName, TargetType.Instance); 
-        _createManagedTarget(address(this), INSTANCE_ADMIN_TARGET_NAME, TargetType.Instance); 
-        _createManagedTarget(address(_instance.getInstanceStore()), INSTANCE_STORE_TARGET_NAME, TargetType.Instance); 
-        _createManagedTarget(address(_instance.getBundleSet()), BUNDLE_SET_TARGET_NAME, TargetType.Instance); 
-        _createManagedTarget(address(_instance.getRiskSet()), RISK_SET_TARGET_NAME, TargetType.Instance); 
+        _createInstanceTarget(address(_instance), instanceTargetName); 
+        _createInstanceTarget(address(this), INSTANCE_ADMIN_TARGET_NAME); 
+        _createInstanceTarget(address(_instance.getInstanceStore()), INSTANCE_STORE_TARGET_NAME); 
+        _createInstanceTarget(address(_instance.getProductStore()), PRODUCT_STORE_TARGET_NAME); 
+        _createInstanceTarget(address(_instance.getBundleSet()), BUNDLE_SET_TARGET_NAME); 
+        _createInstanceTarget(address(_instance.getRiskSet()), RISK_SET_TARGET_NAME); 
+    }
+
+
+    function _createInstanceTarget(address target, string memory name) internal {
+        _createTarget(target, name, TargetType.Instance, true); 
     }
 
 
@@ -155,29 +140,13 @@ contract InstanceAdmin is
         external
         restricted()
     {
-        // checks
-        AccessAdminLib.checkIsRegistered(address(getRegistry()), componentAddress, expectedType);
-
-        IInstanceLinkedComponent component = IInstanceLinkedComponent(componentAddress);
-        IAuthorization authorization = component.getAuthorization();
-        _checkAuthorization(address(authorization), expectedType, getRelease(), false, false);
+        IAuthorization authorization = AccessAdminLib.checkComponentInitialization(
+            this, _authorization, componentAddress, expectedType);
 
         // effects
         _createRoles(authorization);
-        _createManagedTarget(componentAddress, authorization.getMainTargetName(), TargetType.Component);
+        _createTarget(componentAddress, authorization.getMainTargetName(), TargetType.Component, true);
         _createTargetAuthorizations(authorization);
-
-        // increase component count
-        _components++;
-    }
-
-    function getRelease()
-        public
-        view
-        override
-        returns (VersionPart release)
-    {
-        return _release;
     }
 
 
@@ -191,24 +160,18 @@ contract InstanceAdmin is
         restricted()
         returns (RoleId roleId)
     {
-        // check role does not yet exist
-        if (roleExists(name)) {
-            revert ErrorAccessAdminRoleAlreadyCreated(
-                getRoleForName(name),
-                name);
-        }
-
         // create roleId
         roleId = AccessAdminLib.getCustomRoleId(_customRoleIdNext++);
 
         // create role
         _createRole(
             roleId, 
-            AccessAdminLib.toRole(
+            AccessAdminLib.roleInfo(
                 adminRoleId, 
-                IAccess.RoleType.Custom, 
+                IAccess.TargetType.Custom, 
                 maxMemberCount, 
-                name));
+                name),
+            true); // revert on existing role
     }
 
 
@@ -243,7 +206,7 @@ contract InstanceAdmin is
     }
 
 
-    /// @dev Create a new custom target.
+    /// @dev Create a new contract target.
     /// The target needs to be an access managed contract.
     function createTarget(
         address target, 
@@ -253,10 +216,11 @@ contract InstanceAdmin is
         restricted()
         returns (RoleId contractRoleId)
     {
-        return _createManagedTarget(
+        return _createTarget(
             target, 
             name, 
-            TargetType.Custom);
+            TargetType.Contract,
+            true); // check authority matches
     }
 
 
@@ -269,8 +233,7 @@ contract InstanceAdmin is
         external
         restricted()
     {
-        _checkComponentOrCustomTarget(target);
-        _authorizeTargetFunctions(target, roleId, functions, true);
+        _authorizeTargetFunctions(target, roleId, functions, true, true);
     }
 
 
@@ -282,8 +245,7 @@ contract InstanceAdmin is
         external
         restricted()
     {
-        _checkComponentOrCustomTarget(target);
-        _authorizeTargetFunctions(target, ADMIN_ROLE(), functions, false);
+        _authorizeTargetFunctions(target, ADMIN_ROLE(), functions, true, false);
     }
 
 
@@ -300,28 +262,20 @@ contract InstanceAdmin is
 
     function setTargetLocked(address target, bool locked) 
         external 
-        // not restricted(): might need to operate on targets while instance is locked
+        // not restricted(): need to operate on locked instances to unlock instance
         onlyInstanceService()
     {
         _setTargetLocked(target, locked);
     }
 
 
-    function setComponentLocked(address target, bool locked) 
+    function setContractLocked(address target, bool locked) 
         external 
-        restricted()
+        restricted() // component service
     {
         _setTargetLocked(target, locked);
     }
 
-    /// @dev Returns the number of components that have been registered with this instance.   
-    function components() 
-        external 
-        view 
-        returns (uint64)
-    {
-        return _components;
-    }
 
     /// @dev Returns the instance authorization specification used to set up this instance admin.
     function getInstanceAuthorization()
@@ -334,25 +288,6 @@ contract InstanceAdmin is
 
     // ------------------- Internal functions ------------------- //
 
-    function _createRoles(IAuthorization authorization)
-        internal
-    {
-        RoleId[] memory roles = authorization.getRoles();
-        RoleId mainTargetRoleId = authorization.getTargetRole(
-            authorization.getMainTarget());
-
-        for(uint256 i = 0; i < roles.length; i++) {
-            RoleId roleId = roles[i];
-
-            // skip main target role, create role if not exists
-            if (roleId != mainTargetRoleId && !roleExists(roleId)) {
-                _createRole(
-                    roleId,
-                    authorization.getRoleInfo(roleId));
-            }
-        }
-    }
-
 
     function _createTargetAuthorizations(IAuthorization authorization)
         internal
@@ -369,15 +304,4 @@ contract InstanceAdmin is
             }
         }
     }
-
-
-    function _checkComponentOrCustomTarget(address target) 
-        internal
-        view
-    {
-        IAccess.TargetType targetType = getTargetInfo(target).targetType;
-        if (targetType != TargetType.Component && targetType != TargetType.Custom) {
-            revert ErrorInstanceAdminNotComponentOrCustomTarget(target);
-        }
-    }
 }

package/contracts/instance/InstanceAuthorizationV3.sol

@@ -10,6 +10,8 @@ import {ACCOUNTING, ORACLE, POOL, INSTANCE, COMPONENT, DISTRIBUTION, APPLICATION
 import {BundleSet} from "../instance/BundleSet.sol";
 import {InstanceAdmin} from "../instance/InstanceAdmin.sol";
 import {InstanceStore} from "../instance/InstanceStore.sol";
+import {INSTANCE_TARGET_NAME, INSTANCE_ADMIN_TARGET_NAME, INSTANCE_STORE_TARGET_NAME, PRODUCT_STORE_TARGET_NAME, BUNDLE_SET_TARGET_NAME, RISK_SET_TARGET_NAME} from "./TargetNames.sol";
+import {ProductStore} from "../instance/ProductStore.sol";
 import {ADMIN_ROLE, INSTANCE_OWNER_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
 import {RiskSet} from "../instance/RiskSet.sol"; 
 
@@ -21,19 +23,13 @@ contract InstanceAuthorizationV3
      string public constant INSTANCE_ROLE_NAME = "InstanceRole";
      string public constant INSTANCE_OWNER_ROLE_NAME = "InstanceOwnerRole";
 
-     string public constant INSTANCE_TARGET_NAME = "Instance";
-     string public constant INSTANCE_STORE_TARGET_NAME = "InstanceStore";
-     string public constant INSTANCE_ADMIN_TARGET_NAME = "InstanceAdmin";
-     string public constant BUNDLE_SET_TARGET_NAME = "BundleSet";
-     string public constant RISK_SET_TARGET_NAME = "RiskSet";
-
      constructor()
           Authorization(
                INSTANCE_TARGET_NAME, 
                INSTANCE(), 
                3, 
                COMMIT_HASH,
-               false, 
+               TargetType.Instance, 
                false)
      { }
 
@@ -58,9 +54,9 @@ contract InstanceAuthorizationV3
      {
           _addRole(
                INSTANCE_OWNER_ROLE(),
-               AccessAdminLib.toRole(
+               AccessAdminLib.roleInfo(
                     ADMIN_ROLE(),
-                    RoleType.Custom,
+                    TargetType.Custom,
                     0, // max member count special case: instance nft owner is sole role owner
                     INSTANCE_OWNER_ROLE_NAME));
      }
@@ -70,11 +66,11 @@ contract InstanceAuthorizationV3
           override
      {
           // instance supporting targets
-          _addTarget(INSTANCE_ADMIN_TARGET_NAME);
-          _addTarget(INSTANCE_STORE_TARGET_NAME);
-          _addTarget(BUNDLE_SET_TARGET_NAME);
-          _addTarget(RISK_SET_TARGET_NAME);
-
+          _addInstanceTarget(INSTANCE_ADMIN_TARGET_NAME);
+          _addInstanceTarget(INSTANCE_STORE_TARGET_NAME);
+          _addInstanceTarget(PRODUCT_STORE_TARGET_NAME);
+          _addInstanceTarget(BUNDLE_SET_TARGET_NAME);
+          _addInstanceTarget(RISK_SET_TARGET_NAME);
      }
 
 
@@ -85,6 +81,7 @@ contract InstanceAuthorizationV3
           _setupInstanceAuthorization();
           _setupInstanceAdminAuthorization();
           _setupInstanceStoreAuthorization();
+          _setupProductStoreAuthorization();
           _setupBundleSetAuthorization();
           _setUpRiskSetAuthorization();
      }
@@ -178,7 +175,7 @@ contract InstanceAuthorizationV3
           // authorize component service role
           functions = _authorizeForTarget(INSTANCE_ADMIN_TARGET_NAME, getServiceRole(COMPONENT()));
           _authorize(functions, InstanceAdmin.initializeComponentAuthorization.selector, "initializeComponentAuthoriz");
-          _authorize(functions, InstanceAdmin.setComponentLocked.selector, "setComponentLocked");
+          _authorize(functions, InstanceAdmin.setContractLocked.selector, "setContractLocked");
      }
 
 
@@ -199,10 +196,6 @@ contract InstanceAuthorizationV3
           _authorize(functions, InstanceStore.createComponent.selector, "createComponent");
           _authorize(functions, InstanceStore.updateComponent.selector, "updateComponent");
           _authorize(functions, InstanceStore.createPool.selector, "createPool");
-          _authorize(functions, InstanceStore.createProduct.selector, "createProduct");
-          _authorize(functions, InstanceStore.updateProduct.selector, "updateProduct");
-          _authorize(functions, InstanceStore.createFee.selector, "createFee");
-          _authorize(functions, InstanceStore.updateFee.selector, "updateFee");
           
           // authorize distribution service role
           functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(DISTRIBUTION()));
@@ -234,33 +227,49 @@ contract InstanceAuthorizationV3
           _authorize(functions, InstanceStore.increaseLocked.selector, "increaseLocked");
           _authorize(functions, InstanceStore.decreaseLocked.selector, "decreaseLocked");
 
-          // authorize product service role
-          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(RISK()));
-          _authorize(functions, InstanceStore.createRisk.selector, "createRisk");
-          _authorize(functions, InstanceStore.updateRisk.selector, "updateRisk");
-          _authorize(functions, InstanceStore.updateRiskState.selector, "updateRiskState");
+     }
+
+     function _setupProductStoreAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          functions = _authorizeForTarget(PRODUCT_STORE_TARGET_NAME, getServiceRole(COMPONENT()));
+          _authorize(functions, ProductStore.createProduct.selector, "createProduct");
+          _authorize(functions, ProductStore.updateProduct.selector, "updateProduct");
+          _authorize(functions, ProductStore.createFee.selector, "createFee");
+          _authorize(functions, ProductStore.updateFee.selector, "updateFee");
 
           // authorize application service role
-          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(APPLICATION()));
-          _authorize(functions, InstanceStore.createApplication.selector, "createApplication");
-          _authorize(functions, InstanceStore.updateApplication.selector, "updateApplication");
-          _authorize(functions, InstanceStore.updateApplicationState.selector, "updateApplicationState");
+          functions = _authorizeForTarget(PRODUCT_STORE_TARGET_NAME, getServiceRole(APPLICATION()));
+          _authorize(functions, ProductStore.createApplication.selector, "createApplication");
+          _authorize(functions, ProductStore.updateApplication.selector, "updateApplication");
+          _authorize(functions, ProductStore.updateApplicationState.selector, "updateApplicationState");
+
+          // authorize policy service role
+          functions = _authorizeForTarget(PRODUCT_STORE_TARGET_NAME, getServiceRole(POLICY()));
+          _authorize(functions, ProductStore.updatePolicy.selector, "updatePolicy");
+          _authorize(functions, ProductStore.updatePolicyState.selector, "updatePolicyState");
 
           // authorize policy service role
-          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(POLICY()));
-          _authorize(functions, InstanceStore.updatePolicy.selector, "updatePolicy");
-          _authorize(functions, InstanceStore.updatePolicyState.selector, "updatePolicyState");
-          _authorize(functions, InstanceStore.createPremium.selector, "createPremium");
-          _authorize(functions, InstanceStore.updatePremiumState.selector, "updatePremiumState");
+          functions = _authorizeForTarget(PRODUCT_STORE_TARGET_NAME, getServiceRole(POLICY()));
+          _authorize(functions, ProductStore.createPremium.selector, "createPremium");
+          _authorize(functions, ProductStore.updatePremiumState.selector, "updatePremiumState");
+
+          // authorize risk service role
+          functions = _authorizeForTarget(PRODUCT_STORE_TARGET_NAME, getServiceRole(RISK()));
+          _authorize(functions, ProductStore.createRisk.selector, "createRisk");
+          _authorize(functions, ProductStore.updateRisk.selector, "updateRisk");
+          _authorize(functions, ProductStore.updateRiskState.selector, "updateRiskState");
 
           // authorize claim service role
-          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(CLAIM()));
-          _authorize(functions, InstanceStore.updatePolicyClaims.selector, "updatePolicyClaims");
-          _authorize(functions, InstanceStore.createClaim.selector, "createClaim");
-          _authorize(functions, InstanceStore.updateClaim.selector, "updateClaim");
-          _authorize(functions, InstanceStore.createPayout.selector, "createPayout");
-          _authorize(functions, InstanceStore.updatePayout.selector, "updatePayout");
-          _authorize(functions, InstanceStore.updatePayoutState.selector, "updatePayoutState");
+          functions = _authorizeForTarget(PRODUCT_STORE_TARGET_NAME, getServiceRole(CLAIM()));
+          _authorize(functions, ProductStore.updatePolicyClaims.selector, "updatePolicyClaims");
+          _authorize(functions, ProductStore.createClaim.selector, "createClaim");
+          _authorize(functions, ProductStore.updateClaim.selector, "updateClaim");
+          _authorize(functions, ProductStore.createPayout.selector, "createPayout");
+          _authorize(functions, ProductStore.updatePayout.selector, "updatePayout");
+          _authorize(functions, ProductStore.updatePayoutState.selector, "updatePayoutState");
      }
 }