@etherisc/gif-next 0.0.2-c8c9cfc-245 → 0.0.2-c9577b6-545

package/artifacts/contracts/upgradeability/UpgradableProxyWithAdmin.sol/UpgradableProxyWithAdmin.dbg.json

@@ -1,4 +1,4 @@
 {
   "_format": "hh-sol-dbg-1",
-  "buildInfo": "../../../build-info/55c78c663c5f031a07ba7cdf73f6a01f.json"
+  "buildInfo": "../../../build-info/ce4255aa0c72d8241896587f4985f69a.json"
 }

package/artifacts/contracts/upgradeability/Versionable.sol/Versionable.dbg.json

@@ -1,4 +1,4 @@
 {
   "_format": "hh-sol-dbg-1",
-  "buildInfo": "../../../build-info/55c78c663c5f031a07ba7cdf73f6a01f.json"
+  "buildInfo": "../../../build-info/ce4255aa0c72d8241896587f4985f69a.json"
 }

package/contracts/authorization/AccessAdmin.sol

@@ -6,11 +6,12 @@ import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet
 import {ReentrancyGuardUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/ReentrancyGuardUpgradeable.sol";
 
 import {AccessManagerCloneable} from "./AccessManagerCloneable.sol";
+import {ContractLib} from "../shared/ContractLib.sol";
 import {IAccessAdmin} from "./IAccessAdmin.sol";
 import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
 import {Selector, SelectorLib, SelectorSetLib} from "../type/Selector.sol";
 import {Str, StrLib} from "../type/String.sol";
-import {Timestamp, TimestampLib} from "../type/Timestamp.sol";
+import {TimestampLib} from "../type/Timestamp.sol";
 
 
 /**
@@ -79,9 +80,7 @@ contract AccessAdmin is
     }
 
     modifier onlyRoleAdmin(RoleId roleId) {
-        if (!roleExists(roleId)) {
-            revert ErrorRoleUnknown(roleId);
-        }
+        _checkRoleExists(roleId, false);
 
         if (!hasAdminRole(msg.sender, roleId)) {
             revert ErrorNotAdminOfRole(_roleInfo[roleId].adminRoleId);
@@ -96,8 +95,8 @@ contract AccessAdmin is
         _;
     }
 
-    modifier onlyExistingRole(RoleId roleId) {
-        _checkRoleId(roleId);
+    modifier onlyExistingRole(RoleId roleId, bool onlyActiveRole) {
+        _checkRoleExists(roleId, onlyActiveRole);
         _;
     }
 
@@ -113,7 +112,6 @@ contract AccessAdmin is
 
         _setAuthority(address(_authority)); // set authority for oz access managed
         _createAdminAndPublicRoles();
-        _disableInitializers();
     }
 
     //--- view functions for roles ------------------------------------------//
@@ -219,18 +217,6 @@ contract AccessAdmin is
                 selector.toBytes4()));
     }
 
-    function isAccessManaged(address target) public view returns (bool) {
-        if (!_isContract(target)) {
-            return false;
-        }
-
-        (bool success, ) = target.staticcall(
-            abi.encodeWithSelector(
-                AccessManagedUpgradeable.authority.selector));
-
-        return success;
-    }
-
     function canCall(address caller, address target, Selector selector) external virtual view returns (bool can) {
         (can, ) = _authority.canCall(caller, target, selector.toBytes4());
     }
@@ -241,7 +227,8 @@ contract AccessAdmin is
             adminRoleId: adminRoleId,
             roleType: roleType,
             maxMemberCount: maxMemberCount,
-            createdAt: TimestampLib.blockTimestamp()
+            createdAt: TimestampLib.blockTimestamp(),
+            pausedAt: TimestampLib.max()
         });
     }
 
@@ -349,7 +336,6 @@ contract AccessAdmin is
         internal
     {
         RoleId adminRoleId = RoleIdLib.toRoleId(_authority.ADMIN_ROLE());
-        FunctionInfo[] memory functions;
 
         // setup admin role
         _createRoleUnchecked(
@@ -373,14 +359,6 @@ contract AccessAdmin is
                 name: PUBLIC_ROLE_NAME}));
     }
 
-    /// @dev check if target exists and reverts if it doesn't
-    function _checkTarget(address target)
-        internal
-    {
-        if (_targetInfo[target].createdAt.eqz()) {
-            revert ErrorTargetUnknown(target);
-        }
-    }
 
     /// @dev grant the specified role access to all functions in the provided selector list
     function _grantRoleAccessToFunctions(
@@ -398,22 +376,26 @@ contract AccessAdmin is
         // implizit logging: rely on OpenZeppelin log TargetFunctionRoleUpdated
     }
 
+
     /// @dev grant the specified role to the provided account
     function _grantRoleToAccount(RoleId roleId, address account)
         internal
+        onlyExistingRole(roleId, true)
     {
-        _checkRoleId(roleId);
-
         // check max role members will not be exceeded
         if (_roleMembers[roleId].length() >= _roleInfo[roleId].maxMemberCount) {
             revert ErrorRoleMembersLimitReached(roleId, _roleInfo[roleId].maxMemberCount);
         }
 
         // check account is contract for contract role
-        // TODO implement
-        if (_roleInfo[roleId].roleType == RoleType.Contract) {
+        if (
+            _roleInfo[roleId].roleType == RoleType.Contract &&
+            !ContractLib.isContract(account) // will fail in account's constructor
+        ) {
+            revert ErrorRoleMemberNotContract(roleId, account);
         }
 
+        // TODO check account already have roleId
         _roleMembers[roleId].add(account);
         _authority.grantRole(
             RoleId.unwrap(roleId), 
@@ -426,14 +408,15 @@ contract AccessAdmin is
     /// @dev revoke the specified role from the provided account
     function _revokeRoleFromAccount(RoleId roleId, address account)
         internal
+        onlyExistingRole(roleId, false)
     {
-        _checkRoleId(roleId);
 
         // check role removal is permitted
         if (_roleInfo[roleId].roleType == RoleType.Contract) {
-            revert ErrorRoleRemovalDisabled(roleId);
+            revert ErrorRoleMemberRemovalDisabled(roleId, account);
         }
 
+        // TODO check account have roleId?
         _roleMembers[roleId].remove(account);
         _authority.revokeRole(
             RoleId.unwrap(roleId), 
@@ -443,21 +426,6 @@ contract AccessAdmin is
     }
 
 
-    function _checkRoleId(RoleId roleId)
-        internal
-    {
-        if (_roleInfo[roleId].createdAt.eqz()) {
-            revert ErrorRoleUnknown(roleId);
-        }
-
-        uint64 roleIdInt = RoleId.unwrap(roleId);
-        if (roleIdInt == _authority.ADMIN_ROLE()
-            || roleIdInt == _authority.PUBLIC_ROLE())
-        {
-            revert ErrorRoleIsLocked(roleId);
-        }
-    }
-
     /// @dev Creates a role based on the provided parameters.
     /// Checks that the provided role and role id and role name not already used.
     function _createRole(
@@ -548,7 +516,7 @@ contract AccessAdmin is
         }
 
         // check target is an access managed contract
-        if (!isAccessManaged(target)) {
+        if (!ContractLib.isAccessManaged(target)) {
             revert ErrorTargetNotAccessManaged(target);
         }
 
@@ -576,16 +544,52 @@ contract AccessAdmin is
         emit LogTargetCreated(target, targetName);
     }
 
-    function _isContract(address target)
+    function _setTargetClosed(address target, bool locked)
         internal
-        view 
-        returns (bool)
     {
-        uint256 size;
-        assembly {
-            size := extcodesize(target)
+        _checkTarget(target);
+
+        // target locked/unlocked already
+        if(_authority.isTargetClosed(target) == locked) {
+            revert ErrorTargetAlreadyLocked(target, locked);
+        }
+
+        _authority.setTargetClosed(target, locked);
+    }
+
+
+    function _checkRoleExists(
+        RoleId roleId, 
+        bool onlyActiveRole
+    )
+        internal
+        view
+    {
+        if (!roleExists(roleId)) {
+            revert ErrorRoleUnknown(roleId);
+        }
+
+        uint64 roleIdInt = RoleId.unwrap(roleId);
+        if (roleIdInt == _authority.ADMIN_ROLE()
+            || roleIdInt == _authority.PUBLIC_ROLE())
+        {
+            revert ErrorRoleIsLocked(roleId);
+        }
+
+        // check if role is disabled
+        if (onlyActiveRole && _roleInfo[roleId].pausedAt <= TimestampLib.blockTimestamp()) {
+            revert ErrorRoleIsPaused(roleId);
+        }
+    }
+
+
+    /// @dev check if target exists and reverts if it doesn't
+    function _checkTarget(address target)
+        internal
+        view
+    {
+        if (!targetExists(target)) {
+            revert ErrorTargetUnknown(target);
         }
-        return size > 0;
     }
-    
 }

package/contracts/authorization/Authorization.sol

@@ -129,12 +129,15 @@ contract Authorization
      }
 
      function _addComponentTargetWithRole(ObjectType componentType) internal {
+          _addComponentTargetWithRole(componentType, 0);
+     }
+
+     function _addComponentTargetWithRole(ObjectType componentType, uint64 index) internal {
           _addTargetWithRole(
                getTargetName(), 
-               RoleIdLib.toComponentRoleId(componentType, 0),
+               RoleIdLib.toComponentRoleId(componentType, index),
                _toTargetRoleName(
                     getTargetName()));
-
      }
 
      /// @dev Add a contract role for the provided role id and name.
@@ -212,7 +215,8 @@ contract Authorization
                adminRoleId: adminRoleId,
                roleType: roleType,
                maxMemberCount: maxMemberCount,
-               createdAt: TimestampLib.blockTimestamp()});
+               createdAt: TimestampLib.blockTimestamp(),
+               pausedAt: TimestampLib.max()});
      }
 }
 

package/contracts/authorization/IAccess.sol

@@ -21,6 +21,7 @@ interface IAccess {
         uint32 maxMemberCount;
         Str name;
         Timestamp createdAt;
+        Timestamp pausedAt;
     }
 
     struct TargetInfo {

package/contracts/authorization/IAccessAdmin.sol

@@ -41,9 +41,10 @@ interface IAccessAdmin is
     // grant/revoke/renounce role
     error ErrorRoleUnknown(RoleId roleId);
     error ErrorRoleIsLocked(RoleId roleId);
-    error ErrorRoleIsDisabled(RoleId roleId);
+    error ErrorRoleIsPaused(RoleId roleId);
     error ErrorRoleMembersLimitReached(RoleId roleId, uint256 memberCountLimit);
-    error ErrorRoleRemovalDisabled(RoleId roleId);
+    error ErrorRoleMemberNotContract(RoleId roleId, address notContract);
+    error ErrorRoleMemberRemovalDisabled(RoleId roleId, address expectedMember);
 
     // create target
     error ErrorTargetAlreadyCreated(address target, string name);
@@ -54,6 +55,7 @@ interface IAccessAdmin is
 
     // lock target
     error ErrorTagetNotLockable();
+    error ErrorTargetAlreadyLocked(address target, bool isLocked);
 
     // authorize target functions
     error ErrorAuthorizeForAdminRoleInvalid(address target);
@@ -131,6 +133,5 @@ interface IAccessAdmin is
 
     function toRole(RoleId adminRoleId, RoleType roleType, uint32 maxMemberCount, string memory name) external view returns (RoleInfo memory);
     function toFunction(bytes4 selector, string memory name) external view returns (FunctionInfo memory);
-    function isAccessManaged(address target) external view returns (bool);
     function deployer() external view returns (address);
 }

package/contracts/authorization/IServiceAuthorization.sol

@@ -1,11 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
 import {IAccess} from "../authorization/IAccess.sol";
 import {ObjectType} from "../type/ObjectType.sol";
 import {VersionPart} from "../type/Version.sol";
 
-interface IServiceAuthorization {
+interface IServiceAuthorization is IERC165 {
 
      /// @dev Returns the commit hash representing the deployed release
      function getCommitHash()

package/contracts/authorization/ServiceAuthorization.sol

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
 import {IAccess} from "../authorization/IAccess.sol";
 import {ObjectType} from "../type/ObjectType.sol";
 import {IServiceAuthorization} from "./IServiceAuthorization.sol";
@@ -10,30 +12,36 @@ import {TimestampLib} from "../type/Timestamp.sol";
 import {VersionPart, VersionPartLib} from "../type/Version.sol";
 
 /// @dev Base contract for release specific service authorization contracts.
-contract ServiceAuthorization
-     is IServiceAuthorization
+contract ServiceAuthorization is 
+     IServiceAuthorization
 {
-     uint256 public constant GIF_VERSION_3 = 3;
+     uint256 public constant COMMIT_HASH_LENGTH = 40;
+     uint256 public constant GIF_INITIAL_VERSION = 3;
 
-     string private _commitHash;
+     uint256 public immutable VERSION;
+     string public COMMIT_HASH;
 
      ObjectType[] internal _serviceDomains;
      mapping(ObjectType domain => address service) internal _serviceAddress;
      mapping(ObjectType domain => ObjectType[] authorizedDomains) internal _authorizedDomains;
      mapping(ObjectType domain => mapping(ObjectType authorizedDomain => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
 
-     constructor(string memory commitHash) {
-          _commitHash = commitHash;
+     constructor(string memory commitHash, uint256 version) {
+          assert(bytes(commitHash).length == COMMIT_HASH_LENGTH);
+          assert(version >= GIF_INITIAL_VERSION);
+
+          COMMIT_HASH = commitHash;
+          VERSION = version;
           _setupDomains();
           _setupDomainAuthorizations();
      }
 
      function getCommitHash() external view returns(string memory commitHash) {
-          return _commitHash;
+          return COMMIT_HASH;
      }
 
      function getRelease() external view returns(VersionPart release) {
-          return VersionPartLib.toVersionPart(GIF_VERSION_3);
+          return VersionPartLib.toVersionPart(VERSION);
      }
 
      function getServiceDomains() external view returns(ObjectType[] memory serviceDomains) {
@@ -56,6 +64,15 @@ contract ServiceAuthorization
           return _authorizedFunctions[serviceDomain][authorizedDomain];
      }
 
+     // ERC165
+     function supportsInterface(bytes4 interfaceId) public pure returns (bool) {
+          return (
+               interfaceId == type(IServiceAuthorization).interfaceId || 
+               interfaceId == type(IERC165).interfaceId
+          );
+     }
+
+
      /// @dev Overwrite this function for a specific realease.
      function _setupDomains() internal virtual {}
 
@@ -86,5 +103,4 @@ contract ServiceAuthorization
                     name: StrLib.toStr(name),
                     createdAt: TimestampLib.blockTimestamp()}));
      }
-}
-
+}

package/contracts/distribution/BasicDistribution.sol

@@ -2,6 +2,7 @@
 pragma solidity ^0.8.20;
 
 import {Distribution} from "./Distribution.sol";
+import {DISTRIBUTOR} from "../type/ObjectType.sol";
 import {IAuthorization} from "../authorization/IAuthorization.sol";
 import {NftId} from "../type/NftId.sol";
 import {ReferralId} from "../type/Referral.sol";
@@ -81,6 +82,7 @@ contract BasicDistribution is
         external
         virtual
         onlyOwner()
+        onlyNftOfType(distributorNftId, DISTRIBUTOR())
         restricted()
     {
         _updateDistributorType(distributorNftId, distributorType, data);

package/contracts/distribution/Distribution.sol

@@ -2,7 +2,7 @@
 pragma solidity ^0.8.20;
 
 import {Amount} from "../type/Amount.sol";
-import {COMPONENT, DISTRIBUTION} from "../type/ObjectType.sol";
+import {COMPONENT, DISTRIBUTION, DISTRIBUTOR} from "../type/ObjectType.sol";
 import {IAuthorization} from "../authorization/IAuthorization.sol";
 import {IDistributionService} from "./IDistributionService.sol";
 import {NftId, NftIdLib} from "../type/NftId.sol";
@@ -128,6 +128,7 @@ abstract contract Distribution is
         virtual
         restricted()
         onlyDistributor()
+        onlyNftOfType(distributorNftId, DISTRIBUTOR())
         onlyNftOwner(distributorNftId)
         returns (Amount withdrawnAmount) 
     {
@@ -164,7 +165,7 @@ abstract contract Distribution is
         $._distributionService = IDistributionService(_getServiceAddress(DISTRIBUTION())); 
         $._componentService = IComponentService(_getServiceAddress(COMPONENT())); 
 
-        registerInterface(type(IDistributionComponent).interfaceId);
+        _registerInterface(type(IDistributionComponent).interfaceId);
     }
 
     /// @dev Sets the distribution fees to the provided values.