@etherisc/gif-next 0.0.2-ccfa4c7-304 → 0.0.2-cd48412-522

package/contracts/authorization/ServiceAuthorization.sol

@@ -1,106 +1,320 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
-
 import {IAccess} from "../authorization/IAccess.sol";
-import {ObjectType} from "../type/ObjectType.sol";
 import {IServiceAuthorization} from "./IServiceAuthorization.sol";
+
+import {ADMIN_ROLE_NAME, PUBLIC_ROLE_NAME} from "./AccessAdmin.sol";
+import {InitializableERC165} from "../shared/InitializableERC165.sol";
+import {ObjectType, ObjectTypeLib, ALL} from "../type/ObjectType.sol";
+import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
 import {SelectorLib} from "../type/Selector.sol";
-import {StrLib} from "../type/String.sol";
+import {Str, StrLib} from "../type/String.sol";
 import {TimestampLib} from "../type/Timestamp.sol";
 import {VersionPart, VersionPartLib} from "../type/Version.sol";
 
-/// @dev Base contract for release specific service authorization contracts.
+
+/// @dev Base contract for release specific service authorization contracts and for Authorization contracts.
 contract ServiceAuthorization is 
+     InitializableERC165,
      IServiceAuthorization
 {
+
+     string public constant COMMIT_HASH = "1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a";
+
      uint256 public constant COMMIT_HASH_LENGTH = 40;
      uint256 public constant GIF_INITIAL_VERSION = 3;
 
-     uint256 public immutable VERSION;
-     string public COMMIT_HASH;
+     string public constant SERVICE_NAME_SUFFIX = "Service";
+     string public constant ROLE_NAME_SUFFIX = "_Role";
 
+     ObjectType public immutable DOMAIN;
+     uint256 internal immutable _release;
+     string internal _commitHash;
+
+     string internal _mainTargetName;
+     Str internal _mainTarget;
+
+     // services
      ObjectType[] internal _serviceDomains;
      mapping(ObjectType domain => address service) internal _serviceAddress;
-     mapping(ObjectType domain => ObjectType[] authorizedDomains) internal _authorizedDomains;
-     mapping(ObjectType domain => mapping(ObjectType authorizedDomain => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
 
-     constructor(string memory commitHash, uint256 version) {
-          assert(bytes(commitHash).length == COMMIT_HASH_LENGTH);
-          assert(version >= GIF_INITIAL_VERSION);
+     // roles
+     RoleId[] internal _roles;
+     mapping(RoleId role => RoleInfo info) internal _roleInfo;
+
+     // targets
+     Str[] internal _targets;
+     mapping(Str target => bool exists) internal _targetExists;
+     mapping(Str target => RoleId roleId) internal _targetRole;
+     mapping(Str target => RoleId[] authorizedRoles) internal _authorizedRoles;
+     mapping(Str target => mapping(RoleId authorizedRole => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
+
+
+     constructor(
+          string memory mainTargetName, 
+          ObjectType domain,
+          uint8 release,
+          string memory commitHash
+     )
+     {
+          // checks
+          if (bytes(mainTargetName).length == 0) {
+               revert ErrorAuthorizationMainTargetNameEmpty();
+          }
+
+          if (domain == ObjectTypeLib.zero()) {
+               revert ErrorAuthorizationTargetDomainZero();
+          }
+
+          if (release < VersionPartLib.releaseMin().toInt() || release >= VersionPartLib.releaseMax().toInt()) {
+               revert ErrorAuthorizationReleaseInvalid(release);
+          }
+
+          if (bytes(commitHash).length != COMMIT_HASH_LENGTH) {
+               revert ErrorAuthorizationCommitHashInvalid(commitHash);
+          }
+
+          // effects
+          _initializeERC165();
+          _registerInterfaceNotInitializing(type(IServiceAuthorization).interfaceId);
+
+          _mainTargetName = mainTargetName;
+          _mainTarget = StrLib.toStr(mainTargetName);
+
+          DOMAIN = domain;
+          _release = release;
+          _commitHash = commitHash;
 
-          COMMIT_HASH = commitHash;
-          VERSION = version;
+          // setup of roles defined in OpenZeppelin AccessManager
+          _addRole(ADMIN_ROLE(), _toRoleInfo(ADMIN_ROLE(), RoleType.Core, 1, ADMIN_ROLE_NAME()));
+          _addRole(PUBLIC_ROLE(), _toRoleInfo(ADMIN_ROLE(), RoleType.Core, 1, PUBLIC_ROLE_NAME()));
+
+          // defines service domains relevant for the authorization
           _setupDomains();
           _setupDomainAuthorizations();
      }
 
+     /// @inheritdoc IServiceAuthorization
+     function getDomain() public view returns(ObjectType targetDomain) {
+          return DOMAIN;
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getRelease() public view returns(VersionPart release) {
+          return VersionPartLib.toVersionPart(_release);
+     }
+
+     /// @inheritdoc IServiceAuthorization
      function getCommitHash() external view returns(string memory commitHash) {
-          return COMMIT_HASH;
+          return _commitHash;
      }
 
-     function getRelease() external view returns(VersionPart release) {
-          return VersionPartLib.toVersionPart(VERSION);
+     /// @inheritdoc IServiceAuthorization
+     function getMainTargetName() public view returns (string memory name) {
+          return _mainTargetName;
      }
 
+     /// @inheritdoc IServiceAuthorization
+     function getMainTarget() external view returns(Str target) {
+          return _mainTarget;
+     }
+
+     /// @inheritdoc IServiceAuthorization
      function getServiceDomains() external view returns(ObjectType[] memory serviceDomains) {
           return _serviceDomains;
      }
 
-     function getServiceDomain(uint idx) external view returns(ObjectType serviceDomain) {
+     /// @inheritdoc IServiceAuthorization
+     function getServiceDomain(uint256 idx) external view returns(ObjectType serviceDomain) {
           return _serviceDomains[idx];
      }
 
+     /// @inheritdoc IServiceAuthorization
+     function getServiceTarget(ObjectType serviceDomain) public view returns(Str target) {
+          string memory serviceTargetName = ObjectTypeLib.toVersionedName(
+               ObjectTypeLib.toName(serviceDomain), 
+               "Service", 
+               getRelease());
+
+          return StrLib.toStr(serviceTargetName);
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getServiceRole(ObjectType serviceDomain) public view returns(RoleId serviceRoleId) {
+          // special case domain ALL
+          if (serviceDomain == ALL()) {
+               return PUBLIC_ROLE();
+          }
+
+          Str target = getServiceTarget(serviceDomain);
+          return getTargetRole(target);
+     }
+
+     /// @inheritdoc IServiceAuthorization
      function getServiceAddress(ObjectType serviceDomain) external view returns(address service) {
           return _serviceAddress[serviceDomain];
      }
 
-     function getAuthorizedDomains(ObjectType serviceDomain) external view returns(ObjectType[] memory authorizatedDomains) {
-          return _authorizedDomains[serviceDomain];
+     /// @inheritdoc IServiceAuthorization
+     function getTargetRole(Str target) public view returns(RoleId roleId) {
+          return _targetRole[target];
      }
 
-     function getAuthorizedFunctions(ObjectType serviceDomain, ObjectType authorizedDomain) external view returns(IAccess.FunctionInfo[] memory authorizatedFunctions) {
-          return _authorizedFunctions[serviceDomain][authorizedDomain];
+     /// @inheritdoc IServiceAuthorization
+     function roleExists(RoleId roleId) public view returns(bool exists) {
+          return _roleInfo[roleId].roleType != RoleType.Undefined;
      }
 
-     // ERC165
-     function supportsInterface(bytes4 interfaceId) public pure returns (bool) {
-          return (
-               interfaceId == type(IServiceAuthorization).interfaceId || 
-               interfaceId == type(IERC165).interfaceId
-          );
+     /// @inheritdoc IServiceAuthorization
+     function getRoles() external view returns(RoleId[] memory roles) {
+          return _roles;
      }
 
+     /// @inheritdoc IServiceAuthorization
+     function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory info) {
+          return _roleInfo[roleId];
+     }
 
-     /// @dev Overwrite this function for a specific realease.
+     /// @inheritdoc IServiceAuthorization
+     function getRoleName(RoleId roleId) external view returns (string memory roleName) {
+          return _roleInfo[roleId].name.toString();
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getAuthorizedRoles(Str target) external view returns(RoleId[] memory roleIds) {
+          return _authorizedRoles[target];
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getAuthorizedFunctions(Str target, RoleId roleId) external view returns(FunctionInfo[] memory authorizatedFunctions) {
+          return _authorizedFunctions[target][roleId];
+     }
+
+     /// @dev Defines service domains relevant for the authorization.
+     /// When used for ReleaseAdmin the list defines the services to be registered for the release.
+     /// IMPORTANT: Both the list of the service domains as well as the ordering of the domains is important.
+     /// Trying to register services not in this list or register services in a different order will result in an error.
+     // solhint-disable-next-line no-empty-blocks
      function _setupDomains() internal virtual {}
 
      /// @dev Overwrite this function for a specific realease.
+     // solhint-disable-next-line no-empty-blocks
      function _setupDomainAuthorizations() internal virtual {}
 
      /// @dev Use this method to to add an authorized domain.
      /// The services will need to be registered in the order they are added using this function.
-     function _authorizeDomain(ObjectType serviceDomain, address serviceAddress) internal {
+     function _authorizeServiceDomain(ObjectType serviceDomain, address serviceAddress) internal {
           _serviceDomains.push(serviceDomain);
           _serviceAddress[serviceDomain] = serviceAddress;
+
+          string memory serviceName = ObjectTypeLib.toVersionedName(
+               ObjectTypeLib.toName(serviceDomain), 
+               SERVICE_NAME_SUFFIX, 
+               getRelease());
+
+          _addTargetWithRole(
+               serviceName, 
+               RoleIdLib.toServiceRoleId(serviceDomain, getRelease()), 
+               string(abi.encodePacked(serviceName, ROLE_NAME_SUFFIX)));
+     }
+
+
+     /// @dev Use this method to to add an authorized target together with its target role.
+     function _addTargetWithRole(
+          string memory targetName, 
+          RoleId roleId, 
+          string memory roleName
+     )
+          internal
+     {
+          // add target
+          Str target = StrLib.toStr(targetName);
+          _targets.push(target);
+
+          _targetExists[target] = true;
+
+          // link role to target if defined
+          if (roleId != RoleIdLib.zero()) {
+               // add role if new
+               if (!roleExists(roleId)) {
+                    _addContractRole(roleId, roleName);
+               }
+
+               // link target to role
+               _targetRole[target] = roleId;
+          }
+     }
+
+
+     /// @dev Add a contract role for the provided role id and name.
+     function _addContractRole(RoleId roleId, string memory name) internal {
+          _addRole(
+               roleId,
+               _toRoleInfo(
+                    ADMIN_ROLE(),
+                    RoleType.Contract,
+                    1,
+                    name));
      }
 
+
+     /// @dev Use this method to to add an authorized role.
+     function _addRole(RoleId roleId, RoleInfo memory info) internal {
+          _roles.push(roleId);
+          _roleInfo[roleId] = info;
+     }
+
+
+     /// @dev creates a role info object from the provided parameters
+     function _toRoleInfo(RoleId adminRoleId, RoleType roleType, uint32 maxMemberCount, string memory name) internal view returns (RoleInfo memory info) {
+          return RoleInfo({
+               name: StrLib.toStr(name),
+               adminRoleId: adminRoleId,
+               roleType: roleType,
+               maxMemberCount: maxMemberCount,
+               createdAt: TimestampLib.current(),
+               pausedAt: TimestampLib.max()});
+     }
+
+
      /// @dev Use this method to authorize the specified domain to access the service domain.
-     function _authorizeForService(ObjectType serviceDomain, ObjectType authorizedDomain)
+     function _authorizeForService(
+          ObjectType serviceDomain, 
+          ObjectType authorizedDomain
+     )
           internal
           returns (IAccess.FunctionInfo[] storage authorizatedFunctions)
      {
-          _authorizedDomains[serviceDomain].push(authorizedDomain);
-          return _authorizedFunctions[serviceDomain][authorizedDomain];
+          Str serviceTarget = getServiceTarget(serviceDomain);
+          RoleId authorizedRoleId = getServiceRole(authorizedDomain);
+
+          return _authorizeForTarget(serviceTarget.toString(), authorizedRoleId);
      }
 
+
+     /// @dev Use this method to authorize the specified role to access the target.
+     function _authorizeForTarget(string memory target, RoleId authorizedRoleId)
+          internal
+          returns (IAccess.FunctionInfo[] storage authorizatedFunctions)
+     {
+          Str targetStr = StrLib.toStr(target);
+
+          // add authorized role if not already added
+          if (_authorizedFunctions[targetStr][authorizedRoleId].length == 0) {
+               _authorizedRoles[targetStr].push(authorizedRoleId);
+          }
+
+          return _authorizedFunctions[targetStr][authorizedRoleId];
+     }
+
+
      /// @dev Use this method to authorize a specific function authorization
      function _authorize(IAccess.FunctionInfo[] storage functions, bytes4 selector, string memory name) internal {
           functions.push(
                IAccess.FunctionInfo({
                     selector: SelectorLib.toSelector(selector),
                     name: StrLib.toStr(name),
-                    createdAt: TimestampLib.blockTimestamp()}));
+                    createdAt: TimestampLib.current()}));
      }
 }

package/contracts/distribution/BasicDistribution.sol

@@ -95,6 +95,7 @@ contract BasicDistribution is
      * referral codes need to be unique
      */
     function createReferral(
+        NftId distributorNftId,
         string memory code,
         UFixed discountPercentage,
         uint32 maxReferrals,
@@ -104,10 +105,10 @@ contract BasicDistribution is
         external
         virtual
         restricted()
-        onlyDistributor()
+        onlyNftOwner(distributorNftId)
         returns (ReferralId referralId)
     {
-        NftId distributorNftId = getDistributorNftId(msg.sender);
+        _checkNftType(distributorNftId, DISTRIBUTOR());
         return _createReferral(
             distributorNftId,
             code,
@@ -122,20 +123,18 @@ contract BasicDistribution is
         NftId instanceNftId,
         IAuthorization authorization, 
         address initialOwner,
-        string memory name,
-        address token
+        string memory name
     )
         internal
         virtual
         onlyInitializing()
     {
-        _initializeDistribution(
+        __Distribution_init(
             registry, 
             instanceNftId, 
             authorization,
+            false,
             initialOwner, 
-            name, 
-            token, 
-            ""); // component specifc data
+            name); 
     }
 }

package/contracts/distribution/BasicDistributionAuthorization.sol

@@ -8,7 +8,7 @@ import {Authorization} from "../authorization/Authorization.sol";
 import {BasicDistribution} from "./BasicDistribution.sol"; 
 import {Distribution} from "./Distribution.sol";
 import {COMPONENT, DISTRIBUTION} from "../type/ObjectType.sol";
-import {RoleId, PUBLIC_ROLE} from "../type/RoleId.sol";
+import {PUBLIC_ROLE} from "../type/RoleId.sol";
 import {TokenHandler} from "../shared/TokenHandler.sol";
 
 
@@ -16,15 +16,22 @@ contract BasicDistributionAuthorization
      is Authorization
 {
 
-     constructor(string memory distributionlName)
-          Authorization(distributionlName, DISTRIBUTION(), true, true)
+     constructor(string memory distributionName)
+          Authorization(
+               distributionName, 
+               DISTRIBUTION(), 
+               3,
+               COMMIT_HASH,
+               true, 
+               true)
      {}
 
      function _setupServiceTargets()
           internal
           virtual override
      {
-          _addServiceTargetWithRole(COMPONENT());
+          _authorizeServiceDomain(COMPONENT(), address(11));
+          _authorizeServiceDomain(DISTRIBUTION(), address(11));
      }
 
      function _setupTokenHandlerAuthorizations() internal virtual override {

package/contracts/distribution/Distribution.sol

@@ -10,7 +10,7 @@ import {Amount} from "../type/Amount.sol";
 import {COMPONENT, DISTRIBUTION, DISTRIBUTOR} from "../type/ObjectType.sol";
 import {DistributorType} from "../type/DistributorType.sol";
 import {Fee} from "../type/Fee.sol";
-import {NftId, NftIdLib} from "../type/NftId.sol";
+import {NftId} from "../type/NftId.sol";
 import {ReferralId, ReferralStatus, ReferralLib} from "../type/Referral.sol";
 import {InstanceLinkedComponent} from "../shared/InstanceLinkedComponent.sol";
 import {Seconds} from "../type/Seconds.sol";
@@ -28,17 +28,8 @@ abstract contract Distribution is
     struct DistributionStorage {
         IComponentService _componentService;
         IDistributionService _distributionService;
-        mapping(address distributor => NftId distributorNftId) _distributorNftId;
     }
 
-    modifier onlyDistributor() {
-        if (!isDistributor(msg.sender)) {
-            revert ErrorDistributionNotDistributor(msg.sender);
-        }
-        _;
-    }
-
-
     function processRenewal(
         ReferralId referralId,
         uint256 feeAmount
@@ -46,6 +37,7 @@ abstract contract Distribution is
         external
         virtual
         restricted()
+    // solhint-disable-next-line no-empty-blocks
     {
         // default is no action
     }
@@ -56,7 +48,6 @@ abstract contract Distribution is
         external 
         virtual
         restricted()
-        onlyDistributor()
         onlyNftOfType(distributorNftId, DISTRIBUTOR())
         onlyNftOwner(distributorNftId)
         returns (Amount withdrawnAmount) 
@@ -64,29 +55,9 @@ abstract contract Distribution is
         return _withdrawCommission(distributorNftId, amount);
     }
 
-
-    function isDistributor(address candidate)
-        public
-        view
-        returns (bool)
-    {
-        DistributionStorage storage $ = _getDistributionStorage();
-        return $._distributorNftId[candidate].gtz();
-    }
-
-
-    function getDistributorNftId(address distributor)
-        public
-        view
-        returns (NftId distributorNftId)
-    {
-        DistributionStorage storage $ = _getDistributionStorage();
-        return $._distributorNftId[distributor];
-    }
-
-
     function getDiscountPercentage(string memory referralCode)
         external
+        virtual
         view
         returns (
             UFixed discountPercentage, 
@@ -102,6 +73,7 @@ abstract contract Distribution is
         string memory referralCode
     )
         public
+        virtual
         view 
         returns (ReferralId referralId)
     {
@@ -112,7 +84,7 @@ abstract contract Distribution is
 
 
     function calculateRenewalFeeAmount(
-        ReferralId referralId,
+        ReferralId, // referralId
         uint256 netPremiumAmount
     )
         external
@@ -126,34 +98,31 @@ abstract contract Distribution is
 
 
     /// @dev Returns true iff the component needs to be called when selling/renewing policis
-    function isVerifying() external pure returns (bool verifying) {
+    function isVerifying() external virtual pure returns (bool verifying) {
         return true;
     }
 
 
-    function _initializeDistribution(
+    function __Distribution_init(
         address registry,
         NftId productNftId,
         IAuthorization authorization, 
+        bool isInterceptor,
         address initialOwner,
-        string memory name,
-        address token,
-        bytes memory componentData // component specifidc data 
+        string memory name
     )
         internal
         virtual
         onlyInitializing()
     {
-        _initializeInstanceLinkedComponent(
+        __InstanceLinkedComponent_init(
             registry, 
             productNftId, 
             name, 
-            token, 
             DISTRIBUTION(), 
             authorization,
-            true, 
-            initialOwner, 
-            componentData);
+            isInterceptor,
+            initialOwner);
 
         DistributionStorage storage $ = _getDistributionStorage();
         $._distributionService = IDistributionService(_getServiceAddress(DISTRIBUTION())); 
@@ -215,16 +184,11 @@ abstract contract Distribution is
         returns(NftId distributorNftId)
     {
         DistributionStorage storage $ = _getDistributionStorage();
-        if($._distributorNftId[distributor].gtz()) {
-            revert ErrorDistributionAlreadyDistributor(distributor, $._distributorNftId[distributor]);
-        }
 
         distributorNftId = $._distributionService.createDistributor(
             distributor,
             distributorType,
             data);
-
-        $._distributorNftId[distributor] = distributorNftId;
     }
 
     /// @dev Uptates the distributor type for the specified distributor.
@@ -273,14 +237,6 @@ abstract contract Distribution is
         return _getDistributionStorage()._distributionService.withdrawCommission(distributorNftId, amount);
     }
 
-    function _nftTransferFrom(address from, address to, uint256 tokenId, address operator) internal virtual override {
-        // keep track of distributor nft owner
-        emit LogDistributorUpdated(to, operator);
-        DistributionStorage storage $ = _getDistributionStorage();
-        $._distributorNftId[from] = NftIdLib.zero();
-        $._distributorNftId[to] = NftIdLib.toNftId(tokenId);
-    }
-
     function _getDistributionStorage() private pure returns (DistributionStorage storage $) {
         assembly {
             $.slot := DISTRIBUTION_STORAGE_LOCATION_V1