@etherisc/gif-next 0.0.2-d13bb9e-069 → 0.0.2-d1ee1ae-450

package/contracts/authorization/IAccessAdmin.sol

@@ -4,62 +4,94 @@ pragma solidity ^0.8.20;
 import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
 
 import {IAccess} from "./IAccess.sol";
+import {IAuthorization} from "./IAuthorization.sol";
+import {IRegistryLinked} from "../shared/IRegistryLinked.sol";
+import {IRelease} from "../registry/IRelease.sol";
+
+import {NftId} from "../type/NftId.sol";
+import {ObjectType} from "../type/ObjectType.sol";
 import {RoleId} from "../type/RoleId.sol";
 import {Selector} from "../type/Selector.sol";
 import {Str} from "../type/String.sol";
-import {Timestamp} from "../type/Timestamp.sol";
+import {VersionPart} from "../type/Version.sol";
 
 interface IAccessAdmin is 
     IAccessManaged,
-    IAccess
+    IAccess,
+    IRegistryLinked,
+    IRelease
 {
 
-    // roles
-    event LogRoleCreated(RoleId roleId, RoleType roleType, RoleId roleAdminId, string name);
-    event LogTargetCreated(address target, string name);
-    event LogFunctionCreated(address target, Selector selector, string name);
+    // roles, targets and functions
+    event LogAccessAdminRoleCreated(string admin, RoleId roleId, RoleType roleType, RoleId roleAdminId, string name);
+    event LogAccessAdminTargetCreated(string admin, address target, string name);
+
+    event LogAccessAdminRoleGranted(string admin, address account, string roleName);
+    event LogAccessAdminRoleRevoked(string admin, address account, string roleName);
+    event LogAccessAdminFunctionGranted(string admin, address target, string func);
 
     // only deployer modifier
-    error ErrorNotDeployer();
+    error ErrorAccessAdminNotDeployer();
 
     // only role admin modifier
-    error ErrorNotAdminOfRole(RoleId adminRoleId);
+    error ErrorAccessAdminNotAdminOfRole(RoleId adminRoleId, address account);
 
     // only role owner modifier
-    error ErrorNotRoleOwner(RoleId roleId);
+    error ErrorAccessAdminNotRoleOwner(RoleId roleId, address account);
+
+    // initialization
+    error ErrorAccessAdminNotRegistry(address registry);
+    error ErrorAccessAdminAuthorityNotContract(address authority);
+    error ErrorAccessAdminAccessManagerNotAccessManager(address authority);
+    error ErrorAccessAdminAccessManagerEmptyName();
+
+    // check target
+    error ErrorAccessAdminTargetNotCreated(address target);
+    error ErrorAccessAdminTargetNotRegistered(address target);
+    error ErrorAccessAdminTargetTypeMismatch(address target, ObjectType expectedType, ObjectType actualType);
+
+    // check authorization
+    error ErrorAccessAdminAlreadyInitialized(address authorization);
+    error ErrorAccessAdminNotAuthorization(address authorization);
+    error ErrorAccessAdminDomainMismatch(address authorization, ObjectType expectedDomain, ObjectType actualDomain);
+    error ErrorAccessAdminReleaseMismatch(address authorization, VersionPart expectedRelease, VersionPart actualRelease);
+
+    // link to nft
+    error ErrorAccessAdminNotRegistered(address registerable);
 
     // initialize authority
-    error ErrorAuthorityAlreadySet();
-    error ErrorAdminRoleMissing();
+    error ErrorAccessAdminAdminRoleMissing();
 
     // create role
-    error ErrorRoleAlreadyCreated(RoleId roleId, string name);
-    error ErrorRoleAdminNotExisting(RoleId adminRoleId);
-    error ErrorRoleNameEmpty(RoleId roleId);
-    error ErrorRoleNameAlreadyExists(RoleId roleId, string name, RoleId existingRoleId);
+    error ErrorAccessAdminRoleAlreadyCreated(RoleId roleId, string name);
+    error ErrorAccessAdminRoleAdminNotExisting(RoleId adminRoleId);
+    error ErrorAccessAdminRoleNameEmpty(RoleId roleId);
+    error ErrorAccessAdminRoleNameAlreadyExists(RoleId roleId, string name, RoleId existingRoleId);
 
     // grant/revoke/renounce role
-    error ErrorRoleUnknown(RoleId roleId);
-    error ErrorRoleIsLocked(RoleId roleId);
-    error ErrorRoleIsDisabled(RoleId roleId);
-    error ErrorRoleMembersLimitReached(RoleId roleId, uint256 memberCountLimit);
-    error ErrorRoleRemovalDisabled(RoleId roleId);
+    error ErrorAccessAdminRoleUnknown(RoleId roleId);
+    error ErrorAccessAdminRoleIsLocked(RoleId roleId);
+    error ErrorAccessAdminRoleIsPaused(RoleId roleId);
+    error ErrorAccessAdminRoleMembersLimitReached(RoleId roleId, uint256 memberCountLimit);
+    error ErrorAccessAdminRoleMemberNotContract(RoleId roleId, address notContract);
+    error ErrorAccessAdminRoleMemberRemovalDisabled(RoleId roleId, address expectedMember);
 
     // create target
-    error ErrorTargetAlreadyCreated(address target, string name);
-    error ErrorTargetNameEmpty(address target);
-    error ErrorTargetNameAlreadyExists(address target, string name, address existingTarget);
-    error ErrorTargetNotAccessManaged(address target);
-    error ErrorTargetAuthorityMismatch(address expectedAuthority, address actualAuthority);
+    error ErrorAccessAdminTargetAlreadyCreated(address target, string name);
+    error ErrorAccessAdminTargetNameEmpty(address target);
+    error ErrorAccessAdminTargetNameAlreadyExists(address target, string name, address existingTarget);
+    error ErrorAccessAdminTargetNotAccessManaged(address target);
+    error ErrorAccessAdminTargetAuthorityMismatch(address expectedAuthority, address actualAuthority);
 
     // lock target
-    error ErrorTagetNotLockable();
+    error ErrorAccessAdminTagetNotLockable();
+    error ErrorAccessAdminTargetAlreadyLocked(address target, bool isLocked);
 
     // authorize target functions
-    error ErrorAuthorizeForAdminRoleInvalid(address target);
+    error ErrorAccessAdminAuthorizeForAdminRoleInvalid(address target);
 
     // check target
-    error ErrorTargetUnknown(address target);
+    error ErrorAccessAdminTargetUnknown(address target);
 
     /// @dev Set the disabled status of the speicified role.
     /// Role disabling only prevents the role from being granted to new accounts.
@@ -104,14 +136,20 @@ interface IAccessAdmin is
 
     //--- view functions ----------------------------------------------------//
 
+    function getAuthorization() external view returns (IAuthorization authorization);
+    function getLinkedNftId() external view returns (NftId linkedNftId);
+    function getLinkedOwner() external view returns (address linkedOwner);
+
+    function isLocked() external view returns (bool locked);
+
     function roles() external view returns (uint256 numberOfRoles);
     function getRoleId(uint256 idx) external view returns (RoleId roleId);
     function getAdminRole() external view returns (RoleId roleId);
     function getPublicRole() external view returns (RoleId roleId);
 
     function roleExists(RoleId roleId) external view returns (bool exists); 
+    function getRoleForName(string memory name) external view returns (RoleId roleId);
     function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory roleInfo);
-    function getRoleForName(Str name) external view returns (RoleNameInfo memory);
 
     function hasRole(address account, RoleId roleId) external view returns (bool);
     function hasAdminRole(address account, RoleId roleId) external view returns (bool);
@@ -119,17 +157,14 @@ interface IAccessAdmin is
     function getRoleMember(RoleId roleId, uint256 idx) external view returns (address account);
 
     function targetExists(address target) external view returns (bool exists);
-    function isTargetLocked(address target) external view returns (bool locked);
+    function getTargetForName(Str name) external view returns (address target);
     function targets() external view returns (uint256 numberOfTargets);
     function getTargetAddress(uint256 idx) external view returns (address target);
     function getTargetInfo(address target) external view returns (TargetInfo memory targetInfo);
-    function getTargetForName(Str name) external view returns (address target);
+    function isTargetLocked(address target) external view returns (bool locked);
 
     function authorizedFunctions(address target) external view returns (uint256 numberOfFunctions);
     function getAuthorizedFunction(address target, uint256 idx) external view returns (FunctionInfo memory func, RoleId roleId);
-    function canCall(address caller, address target, Selector selector) external view returns (bool can);
 
-    function toRole(RoleId adminRoleId, RoleType roleType, uint32 maxMemberCount, string memory name) external view returns (RoleInfo memory);
-    function toFunction(bytes4 selector, string memory name) external view returns (FunctionInfo memory);
     function deployer() external view returns (address);
 }

package/contracts/authorization/IAuthorization.sol

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
 import {IAccess} from "../authorization/IAccess.sol";
 import {ObjectType} from "../type/ObjectType.sol";
 import {RoleId} from "../type/RoleId.sol";
@@ -8,19 +10,31 @@ import {Str} from "../type/String.sol";
 import {VersionPart} from "../type/Version.sol";
 
 interface IAuthorization is 
+     IERC165,
      IAccess 
 {
 
-     /// @dev Returns the release (VersionPart) for which the authorizations are defined by this contract.
-     /// Matches with the release returned by the linked service authorization.
-     function getRelease() external view returns(VersionPart release);
+     error ErrorAuthorizationMainTargetNameEmpty();
+     error ErrorAuthorizationTargetDomainZero();
 
-     /// @dev Returns the list of involved roles.
-     function getRoles() external view returns(RoleId[] memory roles);
+     /// @dev Returns the main domain of the authorization.
+     function getDomain() external view returns(ObjectType targetDomain);
+
+     /// @dev Returns the list of service targets.
+     function getServiceDomains() external view returns(ObjectType[] memory serviceDomains);
 
      /// @dev Returns the service role for the specified service domain.
      function getServiceRole(ObjectType serviceDomain) external pure returns (RoleId serviceRoleId);
 
+     /// @dev Returns the service target for the specified domain.
+     function getServiceTarget(ObjectType serviceDomain) external view returns(Str serviceTarget);
+
+     /// @dev Returns the component role for the specified domain.
+     function getComponentRole(ObjectType componentDomain) external view returns(RoleId componentRoleId);
+
+     /// @dev Returns the list of involved roles.
+     function getRoles() external view returns(RoleId[] memory roles);
+
      /// @dev Returns the name for the provided role id.
      function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory roleInfo);
 
@@ -30,10 +44,18 @@ interface IAuthorization is
      /// @dev Returns the main target id name as string.
      /// This name is used to derive the target id and a corresponding target role name
      /// Overwrite this function to change the basic pool target name.
-     function getTargetName() external view returns (string memory name);
+     function getMainTargetName() external view returns (string memory name);
 
      /// @dev Returns the main target.
-     function getTarget() external view returns(Str target);
+     function getMainTarget() external view returns(Str target);
+
+     /// @dev Returns the token hander name.
+     /// Only components have a token handler.
+     function getTokenHandlerName() external view returns(string memory name);
+
+     /// @dev Returns the token hander target.
+     /// Only components have a token handler.
+     function getTokenHandlerTarget() external view returns(Str target);
 
      /// @dev Returns the complete list of targets.
      function getTargets() external view returns(Str[] memory targets);
@@ -50,5 +72,9 @@ interface IAuthorization is
 
      /// @dev For the given target and role id the list of authorized functions is returned
      function getAuthorizedFunctions(Str target, RoleId roleId) external view returns(FunctionInfo[] memory authorizatedFunctions);
+
+     /// @dev Returns the release (VersionPart) for which the authorizations are defined by this contract.
+     /// Matches with the release returned by the linked service authorization.
+     function getRelease() external view returns(VersionPart release);
 }
 

package/contracts/authorization/IServiceAuthorization.sol

@@ -1,11 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
 import {IAccess} from "../authorization/IAccess.sol";
 import {ObjectType} from "../type/ObjectType.sol";
 import {VersionPart} from "../type/Version.sol";
 
-interface IServiceAuthorization {
+interface IServiceAuthorization is IERC165 {
 
      /// @dev Returns the commit hash representing the deployed release
      function getCommitHash()

package/contracts/authorization/ServiceAuthorization.sol

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
 import {IAccess} from "../authorization/IAccess.sol";
 import {ObjectType} from "../type/ObjectType.sol";
 import {IServiceAuthorization} from "./IServiceAuthorization.sol";
@@ -10,30 +12,36 @@ import {TimestampLib} from "../type/Timestamp.sol";
 import {VersionPart, VersionPartLib} from "../type/Version.sol";
 
 /// @dev Base contract for release specific service authorization contracts.
-contract ServiceAuthorization
-     is IServiceAuthorization
+contract ServiceAuthorization is 
+     IServiceAuthorization
 {
-     uint256 public constant GIF_VERSION_3 = 3;
+     uint256 public constant COMMIT_HASH_LENGTH = 40;
+     uint256 public constant GIF_INITIAL_VERSION = 3;
 
-     string private _commitHash;
+     uint256 public immutable VERSION;
+     string public COMMIT_HASH;
 
      ObjectType[] internal _serviceDomains;
      mapping(ObjectType domain => address service) internal _serviceAddress;
      mapping(ObjectType domain => ObjectType[] authorizedDomains) internal _authorizedDomains;
      mapping(ObjectType domain => mapping(ObjectType authorizedDomain => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
 
-     constructor(string memory commitHash) {
-          _commitHash = commitHash;
+     constructor(string memory commitHash, uint256 version) {
+          assert(bytes(commitHash).length == COMMIT_HASH_LENGTH);
+          assert(version >= GIF_INITIAL_VERSION);
+
+          COMMIT_HASH = commitHash;
+          VERSION = version;
           _setupDomains();
           _setupDomainAuthorizations();
      }
 
      function getCommitHash() external view returns(string memory commitHash) {
-          return _commitHash;
+          return COMMIT_HASH;
      }
 
      function getRelease() external view returns(VersionPart release) {
-          return VersionPartLib.toVersionPart(GIF_VERSION_3);
+          return VersionPartLib.toVersionPart(VERSION);
      }
 
      function getServiceDomains() external view returns(ObjectType[] memory serviceDomains) {
@@ -56,6 +64,15 @@ contract ServiceAuthorization
           return _authorizedFunctions[serviceDomain][authorizedDomain];
      }
 
+     // ERC165
+     function supportsInterface(bytes4 interfaceId) public pure returns (bool) {
+          return (
+               interfaceId == type(IServiceAuthorization).interfaceId || 
+               interfaceId == type(IERC165).interfaceId
+          );
+     }
+
+
      /// @dev Overwrite this function for a specific realease.
      function _setupDomains() internal virtual {}
 
@@ -86,5 +103,4 @@ contract ServiceAuthorization
                     name: StrLib.toStr(name),
                     createdAt: TimestampLib.blockTimestamp()}));
      }
-}
-
+}

package/contracts/distribution/BasicDistribution.sol

@@ -1,14 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {Distribution} from "./Distribution.sol";
 import {IAuthorization} from "../authorization/IAuthorization.sol";
-import {NftId} from "../type/NftId.sol";
-import {ReferralId} from "../type/Referral.sol";
-import {Fee} from "../type/Fee.sol";
-import {UFixed} from "../type/UFixed.sol";
+
+import {Distribution} from "./Distribution.sol";
 import {DistributorType} from "../type/DistributorType.sol";
+import {DISTRIBUTOR} from "../type/ObjectType.sol";
+import {Fee} from "../type/Fee.sol";
+import {NftId, NftIdLib} from "../type/NftId.sol";
+import {ReferralId} from "../type/Referral.sol";
+import {Seconds} from "../type/Seconds.sol";
 import {Timestamp} from "../type/Timestamp.sol";
+import {UFixed} from "../type/UFixed.sol";
 
 
 contract BasicDistribution is
@@ -36,15 +39,15 @@ contract BasicDistribution is
         UFixed maxDiscountPercentage,
         UFixed commissionPercentage,
         uint32 maxReferralCount,
-        uint32 maxReferralLifetime,
+        Seconds maxReferralLifetime,
         bool allowSelfReferrals,
         bool allowRenewals,
         bytes memory data
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
         returns (DistributorType distributorType)
     {
         return _createDistributorType(
@@ -66,24 +69,25 @@ contract BasicDistribution is
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
         returns(NftId distributorNftId)
     {
         return _createDistributor(distributor, distributorType, data);
     }
 
-    function updateDistributorType(
+    function changeDistributorType(
         NftId distributorNftId,
         DistributorType distributorType,
         bytes memory data
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
+        onlyNftOfType(distributorNftId, DISTRIBUTOR())
     {
-        _updateDistributorType(distributorNftId, distributorType, data);
+        _changeDistributorType(distributorNftId, distributorType, data);
     }
 
     /**
@@ -91,6 +95,7 @@ contract BasicDistribution is
      * referral codes need to be unique
      */
     function createReferral(
+        NftId distributorNftId,
         string memory code,
         UFixed discountPercentage,
         uint32 maxReferrals,
@@ -99,11 +104,11 @@ contract BasicDistribution is
     )
         external
         virtual
-        onlyDistributor()
         restricted()
+        onlyNftOwner(distributorNftId)
         returns (ReferralId referralId)
     {
-        NftId distributorNftId = getDistributorNftId(msg.sender);
+        _checkNftType(distributorNftId, DISTRIBUTOR());
         return _createReferral(
             distributorNftId,
             code,
@@ -118,8 +123,7 @@ contract BasicDistribution is
         NftId instanceNftId,
         IAuthorization authorization, 
         address initialOwner,
-        string memory name,
-        address token
+        string memory name
     )
         internal
         virtual
@@ -129,10 +133,9 @@ contract BasicDistribution is
             registry, 
             instanceNftId, 
             authorization,
+            false,
             initialOwner, 
             name, 
-            token, 
-            "", // registry data
             ""); // component specifc data
     }
 }

package/contracts/distribution/BasicDistributionAuthorization.sol

@@ -1,13 +1,15 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {IAccess} from "../authorization/IAccess.sol";
+import {IInstanceLinkedComponent} from "../shared/IInstanceLinkedComponent.sol";
+
 import {Authorization} from "../authorization/Authorization.sol";
 import {BasicDistribution} from "./BasicDistribution.sol"; 
 import {Distribution} from "./Distribution.sol";
-import {DISTRIBUTION} from "../type/ObjectType.sol";
-import {IAccess} from "../authorization/IAccess.sol";
-import {IInstanceLinkedComponent} from "../shared/IInstanceLinkedComponent.sol";
-import {PUBLIC_ROLE} from "../../contracts/type/RoleId.sol";
+import {COMPONENT, DISTRIBUTION} from "../type/ObjectType.sol";
+import {RoleId, PUBLIC_ROLE} from "../type/RoleId.sol";
+import {TokenHandler} from "../shared/TokenHandler.sol";
 
 
 contract BasicDistributionAuthorization
@@ -15,16 +17,27 @@ contract BasicDistributionAuthorization
 {
 
      constructor(string memory distributionlName)
-          Authorization(distributionlName)
+          Authorization(distributionlName, DISTRIBUTION(), true, true)
      {}
 
-     function _setupTargets()
+     function _setupServiceTargets()
           internal
           virtual override
      {
-          _addComponentTargetWithRole(DISTRIBUTION()); // basic target
+          _addServiceTargetWithRole(COMPONENT());
      }
 
+     function _setupTokenHandlerAuthorizations() internal virtual override {
+          IAccess.FunctionInfo[] storage functions;
+          functions = _authorizeForTarget(getTokenHandlerName(), getServiceRole(COMPONENT()));
+          _authorize(functions, TokenHandler.approve.selector, "approve");
+          _authorize(functions, TokenHandler.setWallet.selector, "setWallet");
+          _authorize(functions, TokenHandler.pushFeeToken.selector, "pushFeeToken");
+
+          // authorize token handler functions for pool service role
+          functions = _authorizeForTarget(getTokenHandlerName(), getServiceRole(DISTRIBUTION()));
+          _authorize(functions, TokenHandler.pushToken.selector, "pushToken");
+     }
 
      function _setupTargetAuthorizations()
           internal
@@ -33,11 +46,11 @@ contract BasicDistributionAuthorization
           IAccess.FunctionInfo[] storage functions;
 
           // authorize public role (open access to any account, only allows to lock target)
-          functions = _authorizeForTarget(getTargetName(), PUBLIC_ROLE());
+          functions = _authorizeForTarget(getMainTargetName(), PUBLIC_ROLE());
           _authorize(functions, BasicDistribution.setFees.selector, "setFees");
           _authorize(functions, BasicDistribution.createDistributorType.selector, "createDistributorType");
           _authorize(functions, BasicDistribution.createDistributor.selector, "createDistributor");
-          _authorize(functions, BasicDistribution.updateDistributorType.selector, "updateDistributorType");
+          _authorize(functions, BasicDistribution.changeDistributorType.selector, "changeDistributorType");
           _authorize(functions, BasicDistribution.createReferral.selector, "createReferral");
           
           _authorize(functions, IInstanceLinkedComponent.withdrawFees.selector, "withdrawFees");