@etherisc/gif-next 0.0.2-ceb30b2-601 → 0.0.2-cf22d7b-845

package/contracts/registry/ServiceAuthorizationsLib.sol

@@ -0,0 +1,173 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {
+     RoleId, 
+     PRODUCT_OWNER_ROLE, POOL_OWNER_ROLE, ORACLE_OWNER_ROLE,
+     APPLICATION_SERVICE_ROLE, BUNDLE_SERVICE_ROLE, COMPONENT_SERVICE_ROLE, DISTRIBUTION_SERVICE_ROLE, INSTANCE_SERVICE_ROLE, POLICY_SERVICE_ROLE, POOL_SERVICE_ROLE, PRODUCT_SERVICE_ROLE, STAKING_SERVICE_ROLE
+} from "../../contracts/type/RoleId.sol";
+
+import {
+     ObjectType, 
+     REGISTRY, SERVICE, PRODUCT, ORACLE, POOL, INSTANCE, COMPONENT, DISTRIBUTION, DISTRIBUTOR, APPLICATION, POLICY, CLAIM, BUNDLE, STAKE, STAKING, PRICE
+} from "../../contracts/type/ObjectType.sol";
+
+import {ComponentService} from "../shared/ComponentService.sol";
+import {InstanceService} from "../instance/InstanceService.sol";
+import {RegistryService} from "./RegistryService.sol";
+
+library ServiceAuthorizationsLib {
+
+     struct ServiceAuthorization {
+          RoleId[] authorizedRole;
+          bytes4[][] authorizedSelectors;
+     }
+
+     /// @dev returns the full list of gif service domains for this release.
+     /// services need to be registered for the release in revers order of this list.
+     function getDomains()
+          external
+          pure
+          returns(
+               ObjectType[] memory domain
+          )
+     {
+          domain = new ObjectType[](11);
+          domain[0] = POLICY();
+          domain[1] = APPLICATION();
+          domain[2] = CLAIM();
+          domain[3] = PRODUCT();
+          domain[4] = POOL();
+          domain[5] = BUNDLE();
+          domain[6] = PRICE();
+          domain[7] = DISTRIBUTION();
+          domain[8] = COMPONENT();
+          domain[9] = INSTANCE();
+          domain[10] = STAKING();
+     }
+
+
+     /// @dev given the target domain this function returns the list of authorized function signatures per authorized domain.
+     function getAuthorizations(ObjectType domain)
+          external
+          pure
+          returns(
+               ServiceAuthorization memory authorizations
+          )
+     {
+          if(domain == REGISTRY()) { return _getRegistryServiceAuthorization(); }
+          if(domain == INSTANCE()) { return _getInstanceServiceAuthorization(); }
+          if(domain == COMPONENT()) { return _getComponentServiceAuthorization(); }
+
+          // disallows access to all functions with a restricted modifier
+          return _getDefaultAuthorizations();
+     }
+
+
+     /// @dev registry service authorization.
+     /// returns all authorized function signatures per authorized domain.
+     /// all listed functions MUST be implemented with a restricted modifier
+     function _getRegistryServiceAuthorization()
+          internal
+          pure
+          returns (ServiceAuthorization memory authz)
+     {
+          uint8 authorizedRoles = 8;
+          authz.authorizedRole = new RoleId[](authorizedRoles);
+          authz.authorizedSelectors = new bytes4[][](authorizedRoles);
+
+          // TODO role ids need to have a stable setup, this is not the case currently
+          authz.authorizedRole[0] = APPLICATION_SERVICE_ROLE();
+          authz.authorizedSelectors[0] = new bytes4[](1);
+          authz.authorizedSelectors[0][0] = RegistryService.registerPolicy.selector;
+
+          authz.authorizedRole[1] = POOL_SERVICE_ROLE();
+          authz.authorizedSelectors[1] = new bytes4[](1);
+          authz.authorizedSelectors[1][0] = RegistryService.registerPool.selector;
+
+          authz.authorizedRole[2] = BUNDLE_SERVICE_ROLE();
+          authz.authorizedSelectors[2] = new bytes4[](1);
+          authz.authorizedSelectors[2][0] = RegistryService.registerBundle.selector;
+
+          authz.authorizedRole[3] = DISTRIBUTION_SERVICE_ROLE();
+          authz.authorizedSelectors[3] = new bytes4[](2);
+          authz.authorizedSelectors[3][0] = RegistryService.registerDistribution.selector;
+          authz.authorizedSelectors[3][1] = RegistryService.registerDistributor.selector;
+
+          authz.authorizedRole[4] = COMPONENT_SERVICE_ROLE();
+          authz.authorizedSelectors[4] = new bytes4[](1);
+          authz.authorizedSelectors[4][0] = RegistryService.registerComponent.selector;
+
+          authz.authorizedRole[5] = INSTANCE_SERVICE_ROLE();
+          authz.authorizedSelectors[5] = new bytes4[](1);
+          authz.authorizedSelectors[5][0] = RegistryService.registerInstance.selector;
+
+          authz.authorizedRole[6] = STAKING_SERVICE_ROLE();
+          authz.authorizedSelectors[6] = new bytes4[](1);
+          authz.authorizedSelectors[6][0] = RegistryService.registerStaking.selector;
+
+          authz.authorizedRole[7] = PRODUCT_SERVICE_ROLE();
+          authz.authorizedSelectors[7] = new bytes4[](1);
+          authz.authorizedSelectors[7][0] = RegistryService.registerProduct.selector;
+     }
+
+
+     /// @dev instance service authorization.
+     /// returns all authorized function signatures per authorized domain.
+     /// all listed functions MUST be implemented with a restricted modifier
+     function _getInstanceServiceAuthorization()
+          internal
+          pure
+          returns (ServiceAuthorization memory authz)
+     {
+          uint8 authorizedRoles = 1;
+          authz.authorizedRole = new RoleId[](authorizedRoles);
+          authz.authorizedSelectors = new bytes4[][](authorizedRoles);
+
+          authz.authorizedRole[0] = COMPONENT_SERVICE_ROLE();
+          authz.authorizedSelectors[0] = new bytes4[](1);
+          authz.authorizedSelectors[0][0] = InstanceService.createComponentTarget.selector;
+     }
+
+
+     /// @dev component service authorization.
+     /// returns all authorized function signatures per authorized domain.
+     /// all listed functions MUST be implemented with a restricted modifier
+     function _getComponentServiceAuthorization()
+          internal
+          pure
+          returns (ServiceAuthorization memory authz)
+     {
+          uint8 authorizedRoles = 4;
+          authz.authorizedRole = new RoleId[](authorizedRoles);
+          authz.authorizedSelectors = new bytes4[][](authorizedRoles);
+
+          authz.authorizedRole[0] = POLICY_SERVICE_ROLE();
+          authz.authorizedSelectors[0] = new bytes4[](1);
+          authz.authorizedSelectors[0][0] = ComponentService.increaseProductFees.selector;
+
+          authz.authorizedRole[1] = DISTRIBUTION_SERVICE_ROLE();
+          authz.authorizedSelectors[1] = new bytes4[](1);
+          authz.authorizedSelectors[1][0] = ComponentService.increaseDistributionBalance.selector;
+
+          authz.authorizedRole[2] = POOL_SERVICE_ROLE();
+          authz.authorizedSelectors[2] = new bytes4[](1);
+          authz.authorizedSelectors[2][0] = ComponentService.increasePoolBalance.selector;
+
+          authz.authorizedRole[3] = BUNDLE_SERVICE_ROLE();
+          authz.authorizedSelectors[3] = new bytes4[](1);
+          authz.authorizedSelectors[3][0] = ComponentService.increaseBundleBalance.selector;
+     }
+
+
+     function _getDefaultAuthorizations()
+          internal
+          pure
+          returns (ServiceAuthorization memory authz)
+     {
+          uint8 authorizedRoles = 0;
+          authz.authorizedRole = new RoleId[](authorizedRoles);
+          authz.authorizedSelectors = new bytes4[][](authorizedRoles);
+     }
+}
+

package/contracts/registry/TokenRegistry.sol

@@ -1,116 +1,315 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {AccessManaged} from "@openzeppelin/contracts/access/manager/AccessManaged.sol";
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
 import {ERC165Checker} from "@openzeppelin/contracts/utils/introspection/ERC165Checker.sol";
 
+import {REGISTRY} from "../type/ObjectType.sol";
+import {VersionPart} from "../type/Version.sol";
+
 import {IRegisterable} from "../shared/IRegisterable.sol";
+
 import {IRegistry} from "./IRegistry.sol";
-import {VersionPart} from "../types/Version.sol";
-import {REGISTRY} from "../types/ObjectType.sol";
-import {NftOwnable} from "../shared/NftOwnable.sol";
+import {IRegistryLinked} from "../shared/IRegistryLinked.sol";
+import {ReleaseManager} from "./ReleaseManager.sol";
+import {RegistryAdmin} from "./RegistryAdmin.sol";
+
 
 /// @title contract to register token per GIF major release.
 contract TokenRegistry is
-    NftOwnable
+    AccessManaged,
+    IRegistryLinked
 {
-    event LogRegistered(address token, string symbol, uint256 decimals);
-    event LogTokenStateSet(address token, VersionPart majorVersion, bool active);
+    event LogTokenRegistryTokenRegistered(uint256 chainId, address token, uint256 decimals, string symbol);
+    event LogTokenRegistryTokenGlobalStateSet(uint256 chainId, address token, bool active);
+    event LogTokenRegistryTokenStateSet(uint256 chainId, address token, VersionPart majorVersion, bool active);
 
-    error NotContract(address account);
-    error NotToken(address account);
-    error TokenDecimalsZero();
-    error TokenMajorVersionInvalid(VersionPart majorVersion);
+    error ErrorTokenRegistryChainIdZero();
+    error ErrorTokenRegistryTokenAddressZero();
 
-    address [] internal _token;
-    mapping(address token => bool registered) internal _registered;
-    mapping(address token => mapping(VersionPart majorVersion => bool isActive)) internal _active;
+    error ErrorTokenRegistryNotRemoteToken(uint256 chainId, address token);
+    error ErrorTokenRegistryTokenAlreadyRegistered(uint256 chainId, address token);
+    error ErrorTokenRegistryTokenNotContract(uint256 chainId, address token);
+    error ErrorTokenRegistryTokenNotErc20(uint256 chainId, address token);
 
-    constructor(
-        address registry
-    )
-    { 
-        initialize(registry);
+    error ErrorTokenRegistryTokenNotRegistered(uint256 chainId, address token);
+    error ErrorTokenRegistryMajorVersionInvalid(VersionPart majorVersion);
+
+    struct TokenInfo {
+        uint256 chainId;
+        address token;
+        uint8 decimals;
+        string symbol;
+        bool active;
+    }
+
+    mapping(uint256 chainId => mapping(address token => TokenInfo info)) internal _tokenInfo;
+    mapping(uint256 chainId => mapping(address token => mapping(VersionPart majorVersion => bool isActive))) internal _active;
+    TokenInfo [] internal _token;
+
+    IRegistry internal _registry;
+    ReleaseManager internal _releaseManager;
+    IERC20Metadata internal _dipToken;
+
+    /// @dev enforces msg.sender is owner of nft (or initial owner of nft ownable)
+    modifier onlyRegisteredToken(uint256 chainId, address token) {
+        if (!isRegistered(chainId, token)) {
+            revert ErrorTokenRegistryTokenNotRegistered(chainId, token);
+        }
+        _;
     }
 
-    function initialize(address registry)
-        public
-        initializer()
+    constructor(IRegistry registry, IERC20Metadata dipToken)
+        AccessManaged(msg.sender)
     {
-        initializeNftOwnable(msg.sender, registry);
+        // set authority
+        address authority = RegistryAdmin(registry.getRegistryAdminAddress()).authority();
+        setAuthority(authority);
+        
+        _registry = registry;
+        _dipToken = dipToken;
+
+        // register dip token
+        uint256 chainId = block.chainid;
+        _registerToken(
+            chainId, 
+            address(_dipToken), 
+            _dipToken.decimals(), 
+            _dipToken.symbol());
     }
 
 
-    /// @dev link ownership of token registry to nft owner of registry service
-    // TODO latter registry service will get new release, new address, new nft, TokenRegistry will not catch that -> use AccessManaged only for services
-    function linkToNftOwnable(address registryAddress) 
+    /// @dev register an onchain token.
+    /// this function verifies that the provided token address is a contract that implements
+    /// the non optional erc20 view functions.
+    function registerToken(address tokenAddress)
         external
-        onlyOwner
+        restricted()
     {
-        IRegistry registry = IRegistry(registryAddress);
-        // TODO use _latest instead of _initial -> but _latest is 0 before first release activation
-        address registryServiceAddress = registry.getServiceAddress(REGISTRY(), registry.getNextVersion());
-
-        _linkToNftOwnable(registryServiceAddress);
+        IERC20Metadata token = _verifyOnchainToken(tokenAddress);
+        _registerToken(block.chainid, tokenAddress, token.decimals(), token.symbol());
     }
 
-    /// @dev token state is informative, registry have no clue about used tokens
-    // component owner is responsible for token selection and operations
-    // service MUST deny registration of component with inactive token 
-    function setActive(address token, VersionPart majorVersion, bool active)
+
+    /// @dev register the remote token with the provided attributes.
+    /// this function may not be used for tokens when chainId == block.chainid.
+    function registerRemoteToken(
+        uint256 chainId,
+        address token,
+        uint8 decimals,
+        string memory symbol
+    )
         external
-        onlyOwner
+        restricted()
     {
-        // verify that token is registered
-        if (!_registered[token]) {
-            _registerToken(token);
+        if (chainId == block.chainid) {
+            revert ErrorTokenRegistryNotRemoteToken(chainId, token);
         }
 
+        _registerToken(chainId, token, decimals, symbol);
+    }
+
+
+    /// @dev set active flag on token itself.
+    /// when setting a token to active=false isActive will return false
+    /// regardless of release specific active value.
+    function setActive(
+        uint256 chainId, 
+        address token, 
+        bool active
+    )
+        external
+        restricted()
+        onlyRegisteredToken(chainId, token)
+    {
+        _tokenInfo[chainId][token].active = active;
+        emit LogTokenRegistryTokenGlobalStateSet(chainId, token, active);
+    }
+
+
+    /// @dev sets active state for specified token and major version.
+    /// internally calls setActiveWithVersionCheck() with enforcing version check.
+    /// token state is informative, registry have no clue about used tokens
+    /// component owner is responsible for token selection and operations
+    /// service MUST deny registration of component with inactive token.
+    function setActiveForVersion(
+        uint256 chainId, 
+        address token, 
+        VersionPart majorVersion, 
+        bool active
+    )
+        external
+        restricted()
+        onlyRegisteredToken(chainId, token)
+    {
+        _setActiveWithVersionCheck(chainId, token, majorVersion, active, true);
+    }
+
+
+    /// @dev as setActiveForVersion() with the option to skip the version check.
+    /// enforcing the version check checks if the provided major version with the release manager. 
+    /// the function reverts if the provided majorVersion is unknown to the release manager.
+    function setActiveWithVersionCheck(
+        uint256 chainId, 
+        address token, 
+        VersionPart majorVersion, 
+        bool active,
+        bool enforceVersionCheck
+    )
+        external
+        restricted()
+        onlyRegisteredToken(chainId, token)
+    {
+        _setActiveWithVersionCheck(chainId, token, majorVersion, active, enforceVersionCheck);
+    }
+
+
+    function _setActiveWithVersionCheck(
+        uint256 chainId, 
+        address token, 
+        VersionPart majorVersion, 
+        bool active,
+        bool enforceVersionCheck
+    )
+        internal
+    {
         // verify valid major version
-        // ensure major version increments is one
-        uint256 version = majorVersion.toInt();
-        if (!getRegistry().isValidRelease(majorVersion)) {
-            revert TokenMajorVersionInvalid(majorVersion);
+        if(enforceVersionCheck) {
+            uint256 version = majorVersion.toInt();
+            if (!getRegistry().isActiveRelease(majorVersion)) {
+                revert ErrorTokenRegistryMajorVersionInvalid(majorVersion);
+            }
         }
 
-        _active[token][majorVersion] = active;
+        _active[chainId][token][majorVersion] = active;
 
-        emit LogTokenStateSet(token, majorVersion, active);
+        emit LogTokenRegistryTokenStateSet(chainId, token, majorVersion, active);
     }
 
+    /// @dev returns the dip token for this chain
+    function getDipToken() external view returns (IERC20Metadata dipToken) {
+        return _dipToken;
+    }
+
+    /// @dev returns the number of registered tokens
     function tokens() external view returns (uint256) {
         return _token.length;
     }
 
-    function getToken(uint256 idx) external view returns (IERC20Metadata token) {
-        return IERC20Metadata(_token[idx]);
+    /// @dev returns the token info for the specified index position [0 .. tokens() - 1].
+    function getTokenInfo(uint256 idx) external view returns (TokenInfo memory tokenInfo) {
+        return _token[idx];
     }
 
-    function isRegistered(address token) external view returns (bool) {
-        return _registered[token];
+    /// @dev returns the token info for the specified token coordinates.
+    function getTokenInfo(uint256 chainId, address token) external view returns (TokenInfo memory tokenInfo) {
+        return _tokenInfo[chainId][token];
     }
 
-    function isActive(address token, VersionPart majorVersion) external view returns (bool) {
-        return _active[token][majorVersion];
+    /// @dev returns true iff the specified token has been registered for this TokenRegistry contract.
+    function isRegistered(uint256 chainId, address token) public view returns (bool) {
+        return _tokenInfo[chainId][token].chainId > 0;
     }
 
-    /// @dev some sanity checks to prevent unintended registration
-    function _registerToken(address token) internal {
+    /// @dev returns true iff both the token is active for the specfied version and the global token state is active
+    function isActive(uint256 chainId, address token, VersionPart majorVersion) external view returns (bool) {
+        if(!_tokenInfo[chainId][token].active) {
+            return false;
+        }
+
+        return _active[chainId][token][majorVersion];
+    }
+
+    function getDipTokenAddress() external view returns (address) {
+        return address(_dipToken);
+    }
+
+    //--- IRegistryLinked --------------------------------------------------//
+
+    /// @dev returns the dip token for this chain
+    function getRegistry() public view returns (IRegistry) {
+        return _registry;
+    }
+
+    //--- internal functions ------------------------------------------------//
+
+
+    /// @dev checks if provided token address refers to a smart contract that implements 
+    /// erc20 functionality (via its non-optional functions)
+    function _verifyOnchainToken(address tokenAddress)
+        internal
+        virtual
+        view
+        returns (IERC20Metadata token)
+    {
+        token = IERC20Metadata(tokenAddress);
+        uint256 chainId = block.chainid;
 
         // MUST be contract
-        if(token.code.length == 0) {
-            revert NotContract(token);
+        if(tokenAddress.code.length == 0) {
+            revert ErrorTokenRegistryTokenNotContract(chainId, tokenAddress);
+        }
+
+        // MUST implement required erc20 view functions
+        if(!_implementsErc20Functions(token)) {
+            revert ErrorTokenRegistryTokenNotErc20(chainId, tokenAddress);
+        }
+    }
+
+
+    /// @dev checks availability of non-optional view functions
+    /// https://eips.ethereum.org/EIPS/eip-20#methods
+    function _implementsErc20Functions(IERC20Metadata token) internal view returns (bool implementsErc20Functions) {
+        try token.totalSupply() returns (uint256) {
+            // so far so goood
+        } catch {
+            return false;
         }
 
-        // MUST have decimals > 0 (indicator that this is in fact an erc20 token)
-        IERC20Metadata erc20 = IERC20Metadata(token);
-        if(erc20.decimals() == 0) {
-            revert TokenDecimalsZero();
+        try token.balanceOf(address(1)) returns (uint256) {
+            // so far so goood
+        } catch {
+            return false;
         }
 
-        _registered[token] = true;
-        _token.push(token);
+        try token.allowance(address(1), address(2)) returns (uint256) {
+            // so far so goood
+        } catch {
+            return false;
+        }
+
+        return true;
+    }
+
+    /// @dev some sanity checks to prevent unintended registration:
+    /// - token not yet registered
+    /// - chainId not zero
+    /// - token address not zero
+    function _registerToken(uint256 chainId, address token, uint8 decimals, string memory symbol) internal {
+
+        if (isRegistered(chainId, token)) {
+            revert ErrorTokenRegistryTokenAlreadyRegistered(chainId, token);
+        }
+
+        if(chainId == 0) {
+            revert ErrorTokenRegistryChainIdZero();
+        }
+
+        if(token == address(0)) {
+            revert ErrorTokenRegistryTokenAddressZero();
+        }
+
+        TokenInfo memory tokenInfo = TokenInfo({
+            chainId: chainId,
+            token: token,
+            decimals: decimals,
+            symbol: symbol,
+            active: true});
+
+        _tokenInfo[chainId][token] = tokenInfo;
+        _token.push(tokenInfo);
 
-        emit LogRegistered(token, erc20.symbol(), erc20.decimals());
+        emit LogTokenRegistryTokenRegistered(chainId, token, decimals, symbol);
     }
 }