@etherisc/gif-next 0.0.2-d16f92c-416 → 0.0.2-d1ee1ae-450

package/contracts/authorization/IAccess.sol

@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import {RoleId} from "../type/RoleId.sol";
+import {Selector} from "../type/Selector.sol";
+import {Str} from "../type/String.sol";
+import {Timestamp} from "../type/Timestamp.sol";
+
+interface IAccess {
+
+    enum RoleType {
+        Undefined, // no role must have this type
+        Contract, // roles assigned to contracts, cannot be revoked
+        Gif, // framework roles that may be freely assigned and revoked
+        Custom // use case specific rules for components
+    }
+
+    struct RoleInfo {
+        // slot 0
+        RoleId adminRoleId; 
+        RoleType roleType; 
+        uint32 maxMemberCount; 
+        Timestamp createdAt; 
+        Timestamp pausedAt; 
+        // slot 1
+        Str name;
+    }
+
+    struct TargetInfo {
+        // slot 0
+        Str name;
+        // slot 1
+        bool isCustom;
+        Timestamp createdAt;
+    }
+
+    struct FunctionInfo {
+        // slot 0
+        Str name; // function name
+        // slot 1
+        Selector selector; // function selector
+        Timestamp createdAt;
+    }
+
+    struct RoleNameInfo {
+        // slot 0
+        RoleId roleId;
+        bool exists;
+    }
+
+    struct TargeNameInfo {
+        // slot 0
+        address target;
+        bool exists;
+    }
+
+}

package/contracts/authorization/IAccessAdmin.sol

@@ -0,0 +1,170 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
+
+import {IAccess} from "./IAccess.sol";
+import {IAuthorization} from "./IAuthorization.sol";
+import {IRegistryLinked} from "../shared/IRegistryLinked.sol";
+import {IRelease} from "../registry/IRelease.sol";
+
+import {NftId} from "../type/NftId.sol";
+import {ObjectType} from "../type/ObjectType.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {Selector} from "../type/Selector.sol";
+import {Str} from "../type/String.sol";
+import {VersionPart} from "../type/Version.sol";
+
+interface IAccessAdmin is 
+    IAccessManaged,
+    IAccess,
+    IRegistryLinked,
+    IRelease
+{
+
+    // roles, targets and functions
+    event LogAccessAdminRoleCreated(string admin, RoleId roleId, RoleType roleType, RoleId roleAdminId, string name);
+    event LogAccessAdminTargetCreated(string admin, address target, string name);
+
+    event LogAccessAdminRoleGranted(string admin, address account, string roleName);
+    event LogAccessAdminRoleRevoked(string admin, address account, string roleName);
+    event LogAccessAdminFunctionGranted(string admin, address target, string func);
+
+    // only deployer modifier
+    error ErrorAccessAdminNotDeployer();
+
+    // only role admin modifier
+    error ErrorAccessAdminNotAdminOfRole(RoleId adminRoleId, address account);
+
+    // only role owner modifier
+    error ErrorAccessAdminNotRoleOwner(RoleId roleId, address account);
+
+    // initialization
+    error ErrorAccessAdminNotRegistry(address registry);
+    error ErrorAccessAdminAuthorityNotContract(address authority);
+    error ErrorAccessAdminAccessManagerNotAccessManager(address authority);
+    error ErrorAccessAdminAccessManagerEmptyName();
+
+    // check target
+    error ErrorAccessAdminTargetNotCreated(address target);
+    error ErrorAccessAdminTargetNotRegistered(address target);
+    error ErrorAccessAdminTargetTypeMismatch(address target, ObjectType expectedType, ObjectType actualType);
+
+    // check authorization
+    error ErrorAccessAdminAlreadyInitialized(address authorization);
+    error ErrorAccessAdminNotAuthorization(address authorization);
+    error ErrorAccessAdminDomainMismatch(address authorization, ObjectType expectedDomain, ObjectType actualDomain);
+    error ErrorAccessAdminReleaseMismatch(address authorization, VersionPart expectedRelease, VersionPart actualRelease);
+
+    // link to nft
+    error ErrorAccessAdminNotRegistered(address registerable);
+
+    // initialize authority
+    error ErrorAccessAdminAdminRoleMissing();
+
+    // create role
+    error ErrorAccessAdminRoleAlreadyCreated(RoleId roleId, string name);
+    error ErrorAccessAdminRoleAdminNotExisting(RoleId adminRoleId);
+    error ErrorAccessAdminRoleNameEmpty(RoleId roleId);
+    error ErrorAccessAdminRoleNameAlreadyExists(RoleId roleId, string name, RoleId existingRoleId);
+
+    // grant/revoke/renounce role
+    error ErrorAccessAdminRoleUnknown(RoleId roleId);
+    error ErrorAccessAdminRoleIsLocked(RoleId roleId);
+    error ErrorAccessAdminRoleIsPaused(RoleId roleId);
+    error ErrorAccessAdminRoleMembersLimitReached(RoleId roleId, uint256 memberCountLimit);
+    error ErrorAccessAdminRoleMemberNotContract(RoleId roleId, address notContract);
+    error ErrorAccessAdminRoleMemberRemovalDisabled(RoleId roleId, address expectedMember);
+
+    // create target
+    error ErrorAccessAdminTargetAlreadyCreated(address target, string name);
+    error ErrorAccessAdminTargetNameEmpty(address target);
+    error ErrorAccessAdminTargetNameAlreadyExists(address target, string name, address existingTarget);
+    error ErrorAccessAdminTargetNotAccessManaged(address target);
+    error ErrorAccessAdminTargetAuthorityMismatch(address expectedAuthority, address actualAuthority);
+
+    // lock target
+    error ErrorAccessAdminTagetNotLockable();
+    error ErrorAccessAdminTargetAlreadyLocked(address target, bool isLocked);
+
+    // authorize target functions
+    error ErrorAccessAdminAuthorizeForAdminRoleInvalid(address target);
+
+    // check target
+    error ErrorAccessAdminTargetUnknown(address target);
+
+    /// @dev Set the disabled status of the speicified role.
+    /// Role disabling only prevents the role from being granted to new accounts.
+    /// Existing role members may still execute functions that are authorized for that role.
+    /// Permissioned: the caller must have the manager role (getManagerRole).
+    // TODO move to instance admin
+    // function setRoleDisabled(RoleId roleId, bool disabled) external;
+
+    /// @dev Grant the specified account the provided role.
+    /// Permissioned: the caller must have the roles admin role.
+    // TODO move to instance admin
+    // function grantRole(address account, RoleId roleId) external;
+
+    /// @dev Revoke the provided role from the specified account.
+    /// Permissioned: the caller must have the roles admin role.
+    // TODO move to instance admin
+    // function revokeRole(address account, RoleId roleId) external;
+
+    /// @dev Removes the provided role from the caller
+    // TODO move to instance admin
+    // function renounceRole(RoleId roleId) external;
+
+    /// @dev Set the locked status of the speicified contract.
+    /// IMPORTANT: using this function the AccessManager might itself be put into locked state from which it cannot be unlocked again.
+    /// Overwrite this function if a different use case specific behaviour is required.
+    /// Alternatively, add specific function to just unlock this contract without a restricted() modifier.
+    /// Permissioned: the caller must have the manager role (getManagerRole).
+    // TODO move to instance admin
+    // function setTargetLocked(address target, bool locked) external;
+
+    /// @dev Specifies which functions of the target can be accessed by the provided role.
+    /// Previously existing authorizations will be overwritten.
+    /// Authorizing the admin role is not allowed, use function unauthorizedFunctions for this.
+    /// Permissioned: the caller must have the manager role (getManagerRole).
+    // TODO move to instance admin
+    // function authorizeFunctions(address target, RoleId roleId, FunctionInfo[] memory functions) external;
+
+    /// @dev Specifies for which functionss to remove any previous authorization
+    /// Permissioned: the caller must have the manager role (getManagerRole).
+    // TODO move to instance admin
+    // function unauthorizeFunctions(address target, FunctionInfo[] memory functions) external;
+
+    //--- view functions ----------------------------------------------------//
+
+    function getAuthorization() external view returns (IAuthorization authorization);
+    function getLinkedNftId() external view returns (NftId linkedNftId);
+    function getLinkedOwner() external view returns (address linkedOwner);
+
+    function isLocked() external view returns (bool locked);
+
+    function roles() external view returns (uint256 numberOfRoles);
+    function getRoleId(uint256 idx) external view returns (RoleId roleId);
+    function getAdminRole() external view returns (RoleId roleId);
+    function getPublicRole() external view returns (RoleId roleId);
+
+    function roleExists(RoleId roleId) external view returns (bool exists); 
+    function getRoleForName(string memory name) external view returns (RoleId roleId);
+    function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory roleInfo);
+
+    function hasRole(address account, RoleId roleId) external view returns (bool);
+    function hasAdminRole(address account, RoleId roleId) external view returns (bool);
+    function roleMembers(RoleId roleId) external view returns (uint256 numberOfMembers);
+    function getRoleMember(RoleId roleId, uint256 idx) external view returns (address account);
+
+    function targetExists(address target) external view returns (bool exists);
+    function getTargetForName(Str name) external view returns (address target);
+    function targets() external view returns (uint256 numberOfTargets);
+    function getTargetAddress(uint256 idx) external view returns (address target);
+    function getTargetInfo(address target) external view returns (TargetInfo memory targetInfo);
+    function isTargetLocked(address target) external view returns (bool locked);
+
+    function authorizedFunctions(address target) external view returns (uint256 numberOfFunctions);
+    function getAuthorizedFunction(address target, uint256 idx) external view returns (FunctionInfo memory func, RoleId roleId);
+
+    function deployer() external view returns (address);
+}

package/contracts/authorization/IAuthorization.sol

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
+import {IAccess} from "../authorization/IAccess.sol";
+import {ObjectType} from "../type/ObjectType.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {Str} from "../type/String.sol";
+import {VersionPart} from "../type/Version.sol";
+
+interface IAuthorization is 
+     IERC165,
+     IAccess 
+{
+
+     error ErrorAuthorizationMainTargetNameEmpty();
+     error ErrorAuthorizationTargetDomainZero();
+
+     /// @dev Returns the main domain of the authorization.
+     function getDomain() external view returns(ObjectType targetDomain);
+
+     /// @dev Returns the list of service targets.
+     function getServiceDomains() external view returns(ObjectType[] memory serviceDomains);
+
+     /// @dev Returns the service role for the specified service domain.
+     function getServiceRole(ObjectType serviceDomain) external pure returns (RoleId serviceRoleId);
+
+     /// @dev Returns the service target for the specified domain.
+     function getServiceTarget(ObjectType serviceDomain) external view returns(Str serviceTarget);
+
+     /// @dev Returns the component role for the specified domain.
+     function getComponentRole(ObjectType componentDomain) external view returns(RoleId componentRoleId);
+
+     /// @dev Returns the list of involved roles.
+     function getRoles() external view returns(RoleId[] memory roles);
+
+     /// @dev Returns the name for the provided role id.
+     function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory roleInfo);
+
+     /// @dev Returns true iff the specified role id exists.
+     function roleExists(RoleId roleId) external view returns(bool exists);
+
+     /// @dev Returns the main target id name as string.
+     /// This name is used to derive the target id and a corresponding target role name
+     /// Overwrite this function to change the basic pool target name.
+     function getMainTargetName() external view returns (string memory name);
+
+     /// @dev Returns the main target.
+     function getMainTarget() external view returns(Str target);
+
+     /// @dev Returns the token hander name.
+     /// Only components have a token handler.
+     function getTokenHandlerName() external view returns(string memory name);
+
+     /// @dev Returns the token hander target.
+     /// Only components have a token handler.
+     function getTokenHandlerTarget() external view returns(Str target);
+
+     /// @dev Returns the complete list of targets.
+     function getTargets() external view returns(Str[] memory targets);
+
+     /// @dev Returns true iff the specified target exists.
+     function targetExists(Str target) external view returns(bool exists);
+
+     /// @dev Returns the role id associated with the target.
+     /// If no role is associated with the target the zero role id is returned.
+     function getTargetRole(Str target) external view returns(RoleId roleId);
+
+     /// @dev For the given target the list of authorized role ids is returned
+     function getAuthorizedRoles(Str target) external view returns(RoleId[] memory roleIds);
+
+     /// @dev For the given target and role id the list of authorized functions is returned
+     function getAuthorizedFunctions(Str target, RoleId roleId) external view returns(FunctionInfo[] memory authorizatedFunctions);
+
+     /// @dev Returns the release (VersionPart) for which the authorizations are defined by this contract.
+     /// Matches with the release returned by the linked service authorization.
+     function getRelease() external view returns(VersionPart release);
+}
+

package/contracts/{registry → authorization}/IServiceAuthorization.sol

@@ -1,11 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {IAccessAdmin} from "../shared/IAccessAdmin.sol";
-import {ObjectType} from "../../contracts/type/ObjectType.sol";
-import {VersionPart} from "../../contracts/type/Version.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
 
-interface IServiceAuthorization {
+import {IAccess} from "../authorization/IAccess.sol";
+import {ObjectType} from "../type/ObjectType.sol";
+import {VersionPart} from "../type/Version.sol";
+
+interface IServiceAuthorization is IERC165 {
 
      /// @dev Returns the commit hash representing the deployed release
      function getCommitHash()
@@ -17,7 +19,10 @@ interface IServiceAuthorization {
      function getRelease()
           external
           view
-          returns(VersionPart release, uint domainsCount);
+          returns(VersionPart release);
+
+     /// @dev Returns the service domain for the provided index.
+     function getServiceDomain(uint idx) external view returns(ObjectType serviceDomain);
 
      /// @dev Returns the full list of service domains for this release.
      /// Services need to be registered for the release in revers order of this list.
@@ -30,6 +35,6 @@ interface IServiceAuthorization {
      function getAuthorizedDomains(ObjectType serviceDomain) external view returns(ObjectType[] memory authorizatedDomains);
 
      /// @dev For the given service domain and authorized domain the function returns the list of authorized functions
-     function getAuthorizedFunctions(ObjectType serviceDomain, ObjectType authorizedDomain) external view returns(IAccessAdmin.Function[] memory authorizatedFunctions);
+     function getAuthorizedFunctions(ObjectType serviceDomain, ObjectType authorizedDomain) external view returns(IAccess.FunctionInfo[] memory authorizatedFunctions);
 }
 

package/contracts/{registry → authorization}/ServiceAuthorization.sol

@@ -1,47 +1,57 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {IAccessAdmin} from "../shared/IAccessAdmin.sol";
-import {ObjectType} from "../../contracts/type/ObjectType.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
+import {IAccess} from "../authorization/IAccess.sol";
+import {ObjectType} from "../type/ObjectType.sol";
 import {IServiceAuthorization} from "./IServiceAuthorization.sol";
-import {SelectorLib} from "../../contracts/type/Selector.sol";
-import {StrLib} from "../../contracts/type/String.sol";
-import {VersionPart, VersionPartLib} from "../../contracts/type/Version.sol";
+import {SelectorLib} from "../type/Selector.sol";
+import {StrLib} from "../type/String.sol";
+import {TimestampLib} from "../type/Timestamp.sol";
+import {VersionPart, VersionPartLib} from "../type/Version.sol";
 
 /// @dev Base contract for release specific service authorization contracts.
-contract ServiceAuthorization
-     is IServiceAuthorization
+contract ServiceAuthorization is 
+     IServiceAuthorization
 {
-     uint256 public constant GIF_VERSION = 3;
+     uint256 public constant COMMIT_HASH_LENGTH = 40;
+     uint256 public constant GIF_INITIAL_VERSION = 3;
 
-     string private _commitHash;
+     uint256 public immutable VERSION;
+     string public COMMIT_HASH;
 
      ObjectType[] internal _serviceDomains;
      mapping(ObjectType domain => address service) internal _serviceAddress;
      mapping(ObjectType domain => ObjectType[] authorizedDomains) internal _authorizedDomains;
-     mapping(ObjectType domain => mapping(ObjectType authorizedDomain => IAccessAdmin.Function[] functions)) internal _authorizedFunctions;
+     mapping(ObjectType domain => mapping(ObjectType authorizedDomain => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
+
+     constructor(string memory commitHash, uint256 version) {
+          assert(bytes(commitHash).length == COMMIT_HASH_LENGTH);
+          assert(version >= GIF_INITIAL_VERSION);
 
-     constructor(string memory commitHash) {
-          _commitHash = commitHash;
+          COMMIT_HASH = commitHash;
+          VERSION = version;
           _setupDomains();
           _setupDomainAuthorizations();
      }
 
      function getCommitHash() external view returns(string memory commitHash) {
-          return _commitHash;
+          return COMMIT_HASH;
      }
 
-     function getRelease() external view returns(VersionPart release, uint domainsCount) {
-          return (
-               VersionPartLib.toVersionPart(GIF_VERSION),
-               _serviceDomains.length
-          );
+     function getRelease() external view returns(VersionPart release) {
+          return VersionPartLib.toVersionPart(VERSION);
      }
 
      function getServiceDomains() external view returns(ObjectType[] memory serviceDomains) {
           return _serviceDomains;
      }
 
+     function getServiceDomain(uint idx) external view returns(ObjectType serviceDomain) {
+          return _serviceDomains[idx];
+     }
+
      function getServiceAddress(ObjectType serviceDomain) external view returns(address service) {
           return _serviceAddress[serviceDomain];
      }
@@ -50,10 +60,19 @@ contract ServiceAuthorization
           return _authorizedDomains[serviceDomain];
      }
 
-     function getAuthorizedFunctions(ObjectType serviceDomain, ObjectType authorizedDomain) external view returns(IAccessAdmin.Function[] memory authorizatedFunctions) {
+     function getAuthorizedFunctions(ObjectType serviceDomain, ObjectType authorizedDomain) external view returns(IAccess.FunctionInfo[] memory authorizatedFunctions) {
           return _authorizedFunctions[serviceDomain][authorizedDomain];
      }
 
+     // ERC165
+     function supportsInterface(bytes4 interfaceId) public pure returns (bool) {
+          return (
+               interfaceId == type(IServiceAuthorization).interfaceId || 
+               interfaceId == type(IERC165).interfaceId
+          );
+     }
+
+
      /// @dev Overwrite this function for a specific realease.
      function _setupDomains() internal virtual {}
 
@@ -67,20 +86,21 @@ contract ServiceAuthorization
           _serviceAddress[serviceDomain] = serviceAddress;
      }
 
+     /// @dev Use this method to authorize the specified domain to access the service domain.
      function _authorizeForService(ObjectType serviceDomain, ObjectType authorizedDomain)
           internal
-          returns (IAccessAdmin.Function[] storage authorizatedFunctions)
+          returns (IAccess.FunctionInfo[] storage authorizatedFunctions)
      {
           _authorizedDomains[serviceDomain].push(authorizedDomain);
           return _authorizedFunctions[serviceDomain][authorizedDomain];
      }
 
      /// @dev Use this method to authorize a specific function authorization
-     function _authorize(IAccessAdmin.Function[] storage functions, bytes4 selector, string memory name) internal {
+     function _authorize(IAccess.FunctionInfo[] storage functions, bytes4 selector, string memory name) internal {
           functions.push(
-               IAccessAdmin.Function({
+               IAccess.FunctionInfo({
                     selector: SelectorLib.toSelector(selector),
-                    name: StrLib.toStr(name)}));
+                    name: StrLib.toStr(name),
+                    createdAt: TimestampLib.blockTimestamp()}));
      }
-}
-
+}

package/contracts/distribution/BasicDistribution.sol

@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IAuthorization} from "../authorization/IAuthorization.sol";
+
+import {Distribution} from "./Distribution.sol";
+import {DistributorType} from "../type/DistributorType.sol";
+import {DISTRIBUTOR} from "../type/ObjectType.sol";
+import {Fee} from "../type/Fee.sol";
+import {NftId, NftIdLib} from "../type/NftId.sol";
+import {ReferralId} from "../type/Referral.sol";
+import {Seconds} from "../type/Seconds.sol";
+import {Timestamp} from "../type/Timestamp.sol";
+import {UFixed} from "../type/UFixed.sol";
+
+
+contract BasicDistribution is
+    Distribution
+{
+
+    function setFees(
+        Fee memory distributionFee,
+        Fee memory minDistributionOwnerFee
+    )
+        external
+        virtual
+        onlyOwner()
+        restricted()
+    {
+        _setFees(
+            distributionFee, 
+            minDistributionOwnerFee);
+    }
+
+
+    function createDistributorType(
+        string memory name,
+        UFixed minDiscountPercentage,
+        UFixed maxDiscountPercentage,
+        UFixed commissionPercentage,
+        uint32 maxReferralCount,
+        Seconds maxReferralLifetime,
+        bool allowSelfReferrals,
+        bool allowRenewals,
+        bytes memory data
+    )
+        external
+        virtual
+        restricted()
+        onlyOwner()
+        returns (DistributorType distributorType)
+    {
+        return _createDistributorType(
+            name,
+            minDiscountPercentage,
+            maxDiscountPercentage,
+            commissionPercentage,
+            maxReferralCount,
+            maxReferralLifetime,
+            allowSelfReferrals,
+            allowRenewals,
+            data);
+    }
+
+    function createDistributor(
+        address distributor,
+        DistributorType distributorType,
+        bytes memory data
+    )
+        external
+        virtual
+        restricted()
+        onlyOwner()
+        returns(NftId distributorNftId)
+    {
+        return _createDistributor(distributor, distributorType, data);
+    }
+
+    function changeDistributorType(
+        NftId distributorNftId,
+        DistributorType distributorType,
+        bytes memory data
+    )
+        external
+        virtual
+        restricted()
+        onlyOwner()
+        onlyNftOfType(distributorNftId, DISTRIBUTOR())
+    {
+        _changeDistributorType(distributorNftId, distributorType, data);
+    }
+
+    /**
+     * @dev lets distributors create referral codes.
+     * referral codes need to be unique
+     */
+    function createReferral(
+        NftId distributorNftId,
+        string memory code,
+        UFixed discountPercentage,
+        uint32 maxReferrals,
+        Timestamp expiryAt,
+        bytes memory data
+    )
+        external
+        virtual
+        restricted()
+        onlyNftOwner(distributorNftId)
+        returns (ReferralId referralId)
+    {
+        _checkNftType(distributorNftId, DISTRIBUTOR());
+        return _createReferral(
+            distributorNftId,
+            code,
+            discountPercentage,
+            maxReferrals,
+            expiryAt,
+            data); // data
+    }
+
+    function _initializeBasicDistribution(
+        address registry,
+        NftId instanceNftId,
+        IAuthorization authorization, 
+        address initialOwner,
+        string memory name
+    )
+        internal
+        virtual
+        onlyInitializing()
+    {
+        _initializeDistribution(
+            registry, 
+            instanceNftId, 
+            authorization,
+            false,
+            initialOwner, 
+            name, 
+            ""); // component specifc data
+    }
+}

package/contracts/distribution/BasicDistributionAuthorization.sol

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IAccess} from "../authorization/IAccess.sol";
+import {IInstanceLinkedComponent} from "../shared/IInstanceLinkedComponent.sol";
+
+import {Authorization} from "../authorization/Authorization.sol";
+import {BasicDistribution} from "./BasicDistribution.sol"; 
+import {Distribution} from "./Distribution.sol";
+import {COMPONENT, DISTRIBUTION} from "../type/ObjectType.sol";
+import {RoleId, PUBLIC_ROLE} from "../type/RoleId.sol";
+import {TokenHandler} from "../shared/TokenHandler.sol";
+
+
+contract BasicDistributionAuthorization
+     is Authorization
+{
+
+     constructor(string memory distributionlName)
+          Authorization(distributionlName, DISTRIBUTION(), true, true)
+     {}
+
+     function _setupServiceTargets()
+          internal
+          virtual override
+     {
+          _addServiceTargetWithRole(COMPONENT());
+     }
+
+     function _setupTokenHandlerAuthorizations() internal virtual override {
+          IAccess.FunctionInfo[] storage functions;
+          functions = _authorizeForTarget(getTokenHandlerName(), getServiceRole(COMPONENT()));
+          _authorize(functions, TokenHandler.approve.selector, "approve");
+          _authorize(functions, TokenHandler.setWallet.selector, "setWallet");
+          _authorize(functions, TokenHandler.pushFeeToken.selector, "pushFeeToken");
+
+          // authorize token handler functions for pool service role
+          functions = _authorizeForTarget(getTokenHandlerName(), getServiceRole(DISTRIBUTION()));
+          _authorize(functions, TokenHandler.pushToken.selector, "pushToken");
+     }
+
+     function _setupTargetAuthorizations()
+          internal
+          virtual override
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          // authorize public role (open access to any account, only allows to lock target)
+          functions = _authorizeForTarget(getMainTargetName(), PUBLIC_ROLE());
+          _authorize(functions, BasicDistribution.setFees.selector, "setFees");
+          _authorize(functions, BasicDistribution.createDistributorType.selector, "createDistributorType");
+          _authorize(functions, BasicDistribution.createDistributor.selector, "createDistributor");
+          _authorize(functions, BasicDistribution.changeDistributorType.selector, "changeDistributorType");
+          _authorize(functions, BasicDistribution.createReferral.selector, "createReferral");
+          
+          _authorize(functions, IInstanceLinkedComponent.withdrawFees.selector, "withdrawFees");
+          _authorize(functions, Distribution.withdrawCommission.selector, "withdrawCommission");
+     }
+}
+