@etherisc/gif-next 0.0.2-d437d8d-974 → 0.0.2-d43ca2d-657

package/contracts/authorization/AccessManagerCloneable.sol

@@ -2,15 +2,148 @@
 pragma solidity ^0.8.20;
 
 import {AccessManagerUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagerUpgradeable.sol";
+import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
+import {IAccessManager} from "@openzeppelin/contracts/access/manager/IAccessManager.sol";
 
+import {InitializableERC165} from "../shared/InitializableERC165.sol";
+import {RegistryLinked} from "../shared/RegistryLinked.sol";
+import {VersionPart, VersionLib} from "../type/Version.sol";
+
+
+/// @dev An AccessManager based on OpenZeppelin that is cloneable and has a central lock property.
+/// The lock property allows to lock all services of a release in a central place.
+/// Cloned by upon release preparation and instance cloning.
 contract AccessManagerCloneable is
-    AccessManagerUpgradeable
+    AccessManagerUpgradeable,
+    InitializableERC165,
+    RegistryLinked
 {
+    error ErrorAccessManagerCallerNotAdmin(address caller);
+    error ErrorAccessManagerRegistryAlreadySet(address registry);
+    error ErrorAccessManagerInvalidRelease(VersionPart release);
+
+    error ErrorAccessManagerTargetAdminLocked(address target);
+    error ErrorAccessManagerCallerAdminLocked(address caller);
 
-    function initialize(address initialAdmin)
+    VersionPart private _release;
+    bool private _isLocked;
+
+    modifier onlyAdminRole() {
+        (bool isMember, ) = hasRole(ADMIN_ROLE, msg.sender);
+        if(!isMember) {
+            revert ErrorAccessManagerCallerNotAdmin(msg.sender);
+        }
+        _;
+    }
+
+    function initialize(address admin)
         external
         initializer()
     {
-        __AccessManager_init(initialAdmin);
+        __AccessManager_init(admin);
+        _initializeERC165();
+        _registerInterface(type(IAccessManager).interfaceId);
+    }
+
+
+    /// @dev Completes the setup of the access manager.
+    /// Links the access manager to the registry and sets the release version.
+    function completeSetup(
+        address registry, 
+        VersionPart release
+    )
+        external
+        onlyAdminRole
+        reinitializer(uint64(release.toInt()))
+    {
+        _completeSetup(registry, release, true);
+    }
+
+    /// @dev Completes the setup of the access manager.
+    /// Links the access manager to the registry and sets the release version.
+    function completeSetup(
+        address registry, 
+        VersionPart release,
+        bool verifyRelease
+    )
+        public
+        onlyAdminRole
+        reinitializer(uint64(release.toInt()))
+    {
+        _completeSetup(registry, release, verifyRelease);
+    }
+
+    /// @dev Returns true if the caller is authorized to call the target with the given selector and the manager lock is not set to locked.
+    /// Feturn values as in OpenZeppelin AccessManager.
+    /// For a locked manager the function reverts with ErrorAccessManagerTargetAdminLocked.
+    function canCall(
+        address caller,
+        address target,
+        bytes4 selector
+    )
+        public 
+        view 
+        virtual override 
+        returns (
+            bool immediate, 
+            uint32 delay
+        ) 
+    {
+        (immediate, delay) = super.canCall(caller, target, selector);
+
+        // locking of all contracts under control of this access manager
+        if (isLocked()) {
+            revert ErrorAccessManagerTargetAdminLocked(target);
+        }
+    }
+
+
+    /// @dev Locks/unlocks all services of this access manager.
+    /// Only the corresponding access admin can lock/unlock the services.
+    function setLocked(bool locked)
+        external
+        onlyAdminRole() 
+    {
+        _isLocked = locked;
+    }
+
+
+    /// @dev Returns the release version of this access manager.
+    /// For the registry admin release 3 is returned.
+    /// For the release admin and the instance admin the actual release version is returned.
+    function getRelease() external view returns (VersionPart release) {
+        return _release;
+    }
+
+
+    /// @dev Returns true iff all contracts of this access manager are locked.
+    function isLocked()
+        public
+        view
+        returns (bool)
+    {
+        return _isLocked;
+    }
+
+
+    function _completeSetup(
+        address registry,
+        VersionPart release,
+        bool verifyRelease
+    )
+        internal
+    {
+        // checks
+        if(address(getRegistry()) != address(0)) {
+            revert ErrorAccessManagerRegistryAlreadySet(address(getRegistry()) );
+        }
+
+        if (verifyRelease && !release.isValidRelease()) {
+            revert ErrorAccessManagerInvalidRelease(release);
+        }
+
+        // effects
+        __RegistryLinked_init(registry);
+        _release = release;
     }
 }

package/contracts/authorization/Authorization.sol

@@ -11,60 +11,74 @@ import {TimestampLib} from "../type/Timestamp.sol";
 import {VersionPart, VersionPartLib} from "../type/Version.sol";
 
 contract Authorization
-     is IAuthorization
+    is IAuthorization
 {
-     uint256 public constant GIF_VERSION = 3;
-     string public constant ROLE_NAME_SUFFIX = "Role";
-     string public constant SERVICE_ROLE_NAME_SUFFIX = "ServiceRole";
+    uint256 public constant GIF_RELEASE = 3;
 
-     string internal _mainTargetName = "Component";
-     Str[] internal _targets;
+    string public constant ROLE_NAME_SUFFIX = "Role";
+    string public constant SERVICE_ROLE_NAME_SUFFIX = "ServiceRole";
 
-     mapping(Str target => RoleId roleid) internal _targetRole;
-     mapping(Str target => bool exists) internal _targetExists;
+    ObjectType[] internal _serviceDomains;
+    mapping(ObjectType domain => Str target) internal _serviceTarget;
 
-     RoleId[] internal _roles;
-     mapping(RoleId role => RoleInfo info) internal _roleInfo;
+    string internal _mainTargetName = "Component";
+    Str[] internal _targets;
 
-     mapping(Str target => RoleId[] authorizedRoles) internal _authorizedRoles;
-     mapping(Str target => mapping(RoleId authorizedRole => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
+    mapping(Str target => RoleId roleid) internal _targetRole;
+    mapping(Str target => bool exists) internal _targetExists;
 
+    RoleId[] internal _roles;
+    mapping(RoleId role => RoleInfo info) internal _roleInfo;
 
-     constructor(string memory mainTargetName) {
-          _mainTargetName = mainTargetName;
+    mapping(Str target => RoleId[] authorizedRoles) internal _authorizedRoles;
+    mapping(Str target => mapping(RoleId authorizedRole => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
 
-          _setupRoles();
-          _setupTargets();
-          _setupTargetAuthorizations();
+
+    constructor(string memory mainTargetName) {
+        _mainTargetName = mainTargetName;
+
+        _setupServiceTargets();
+        _setupRoles();
+        _setupTargets();
+        _setupTargetAuthorizations();
+    }
+
+     function getServiceDomains() external view returns(ObjectType[] memory serviceDomains) {
+          return _serviceDomains;
+     }
+
+     function getServiceRole(ObjectType serviceDomain) public virtual pure returns (RoleId serviceRoleId) {
+          return RoleIdLib.roleForTypeAndVersion(
+               serviceDomain, 
+               getRelease());
      }
 
-     function getRelease() public virtual pure returns(VersionPart release) {
-          return VersionPartLib.toVersionPart(GIF_VERSION);
+     function getServiceTarget(ObjectType serviceDomain) external view returns(Str serviceTarget) {
+          return _serviceTarget[serviceDomain];
      }
 
      function getRoles() external view returns(RoleId[] memory roles) {
           return _roles;
      }
 
-     function getServiceRole(ObjectType serviceDomain) public virtual pure returns (RoleId serviceRoleId) {
-          return RoleIdLib.roleForTypeAndVersion(
-               serviceDomain, getRelease());
+     function roleExists(RoleId roleId) public view returns(bool exists) {
+          return _roleInfo[roleId].roleType != RoleType.Undefined;
      }
 
      function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory info) {
           return _roleInfo[roleId];
      }
 
-     function roleExists(RoleId roleId) public view returns(bool exists) {
-          return _roleInfo[roleId].roleType != RoleType.Undefined;
+     function getTargetName() public virtual view returns (string memory name) {
+          return _mainTargetName;
      }
 
-     function getTarget() public view returns(Str) {
-          if (_targets.length > 0) {
-               return _targets[0];
-          }
+     function getMainTarget() public view returns(Str) {
+          return getTarget(_mainTargetName);
+     }
 
-          return StrLib.toStr("");
+     function getTarget(string memory targetName) public view returns(Str target) {
+          return StrLib.toStr(targetName);
      }
 
      function getTargets() external view returns(Str[] memory targets) {
@@ -87,26 +101,60 @@ contract Authorization
           return _authorizedFunctions[target][roleId];
      }
 
-     function getTargetName() public virtual view returns (string memory name) {
-          return _mainTargetName;
-     }
+    function getRelease() public virtual pure returns(VersionPart release) {
+        return VersionPartLib.toVersionPart(GIF_RELEASE);
+    }
+
+     /// @dev Sets up the relevant service targets for the component.
+     /// Overwrite this function for a specific component.
+     function _setupServiceTargets() internal virtual { }
 
-     /// @dev Overwrite this function for a specific realease.
-     /// The first target added represents the components/module main target.
+     /// @dev Sets up the relevant (non-service) targets for the component.
+     /// Overwrite this function for a specific component.
      function _setupTargets() internal virtual { }
 
-     /// @dev Overwrite this function for a specific realease.
+     /// @dev Sets up the relevant roles for the component.
+     /// Overwrite this function for a specific component.
      function _setupRoles() internal virtual {}
 
-     /// @dev Overwrite this function for a specific realease.
+     /// @dev Sets up the relevant target authorizations for the component.
+     /// Overwrite this function for a specific realease.
      function _setupTargetAuthorizations() internal virtual {}
 
+
+     /// @dev Add the service target role for the specified service domain
+     function _addServiceTargetWithRole(ObjectType serviceDomain) internal {
+          // add service domain
+          _serviceDomains.push(serviceDomain);
+
+          // get versioned target name
+          string memory serviceTargetName = ObjectTypeLib.toVersionedName(
+                    ObjectTypeLib.toName(serviceDomain), 
+                    "Service", 
+                    getRelease().toInt());
+
+          _serviceTarget[serviceDomain] = StrLib.toStr(serviceTargetName);
+
+          RoleId serviceRoleId = getServiceRole(serviceDomain);
+          string memory serviceRoleName = ObjectTypeLib.toVersionedName(
+                    ObjectTypeLib.toName(serviceDomain), 
+                    "ServiceRole", 
+                    getRelease().toInt());
+
+          _addTargetWithRole(
+               serviceTargetName,
+               serviceRoleId,
+               serviceRoleName);
+     }
+
+
      /// @dev Use this method to to add an authorized role.
      function _addRole(RoleId roleId, RoleInfo memory info) internal {
           _roles.push(roleId);
           _roleInfo[roleId] = info;
      }
 
+
      /// @dev Add a contract role for the provided role id and name.
      function _addContractRole(RoleId roleId, string memory name) internal {
           _addRole(
@@ -118,6 +166,7 @@ contract Authorization
                     name));
      }
 
+
      /// @dev Add the versioned service role for the specified service domain
      function _addServiceRole(ObjectType serviceDomain) internal {
           _addContractRole(
@@ -128,14 +177,21 @@ contract Authorization
                     getRelease().toInt()));
      }
 
+
      function _addComponentTargetWithRole(ObjectType componentType) internal {
+          _addComponentTargetWithRole(componentType, 0);
+     }
+
+
+     function _addComponentTargetWithRole(ObjectType componentType, uint64 index) internal {
           _addTargetWithRole(
                getTargetName(), 
-               RoleIdLib.toComponentRoleId(componentType, 0),
+               RoleIdLib.toComponentRoleId(componentType, index),
                _toTargetRoleName(
                     getTargetName()));
      }
 
+
      /// @dev Add a contract role for the provided role id and name.
      function _addCustomRole(RoleId roleId, RoleId adminRoleId, uint32 maxMemberCount, string memory name) internal {
           _addRole(
@@ -173,11 +229,13 @@ contract Authorization
           }
      }
 
+
      /// @dev Use this method to to add an authorized target.
      function _addTarget(string memory name) internal {
           _addTargetWithRole(name, RoleIdLib.zero(), "");
      }
 
+
      /// @dev Use this method to authorize the specified role to access the target.
      function _authorizeForTarget(string memory target, RoleId authorizedRoleId)
           internal
@@ -188,6 +246,7 @@ contract Authorization
           return _authorizedFunctions[targetStr][authorizedRoleId];
      }
 
+
      /// @dev Use this method to authorize a specific function authorization
      function _authorize(IAccess.FunctionInfo[] storage functions, bytes4 selector, string memory name) internal {
           functions.push(
@@ -197,13 +256,25 @@ contract Authorization
                     createdAt: TimestampLib.blockTimestamp()}));
      }
 
-     function _toTargetRoleName(string memory targetName) internal view returns (string memory) {
+
+     /// @dev role id for targets registry, staking and instance
+     function _toTargetRoleId(ObjectType targetDomain) 
+          internal
+          pure
+          returns (RoleId targetRoleId)
+     {
+          return RoleIdLib.roleForType(targetDomain);
+     }
+
+
+     function _toTargetRoleName(string memory targetName) internal pure returns (string memory) {
           return string(
                abi.encodePacked(
                     targetName,
                     ROLE_NAME_SUFFIX));
      }
 
+
      /// @dev creates a role info object from the provided parameters
      function _toRoleInfo(RoleId adminRoleId, RoleType roleType, uint32 maxMemberCount, string memory name) internal view returns (RoleInfo memory info) {
           return RoleInfo({
@@ -211,7 +282,8 @@ contract Authorization
                adminRoleId: adminRoleId,
                roleType: roleType,
                maxMemberCount: maxMemberCount,
-               createdAt: TimestampLib.blockTimestamp()});
+               createdAt: TimestampLib.blockTimestamp(),
+               pausedAt: TimestampLib.max()});
      }
 }
 

package/contracts/authorization/IAccess.sol

@@ -21,6 +21,7 @@ interface IAccess {
         uint32 maxMemberCount;
         Str name;
         Timestamp createdAt;
+        Timestamp pausedAt;
     }
 
     struct TargetInfo {

package/contracts/authorization/IAccessAdmin.sol

@@ -4,14 +4,16 @@ pragma solidity ^0.8.20;
 import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
 
 import {IAccess} from "./IAccess.sol";
+import {IRegistryLinked} from "../shared/IRegistryLinked.sol";
 import {RoleId} from "../type/RoleId.sol";
 import {Selector} from "../type/Selector.sol";
 import {Str} from "../type/String.sol";
-import {Timestamp} from "../type/Timestamp.sol";
+import {VersionPart} from "../type/Version.sol";
 
 interface IAccessAdmin is 
     IAccessManaged,
-    IAccess
+    IAccess,
+    IRegistryLinked
 {
 
     // roles
@@ -29,7 +31,6 @@ interface IAccessAdmin is
     error ErrorNotRoleOwner(RoleId roleId);
 
     // initialize authority
-    error ErrorAuthorityAlreadySet();
     error ErrorAdminRoleMissing();
 
     // create role
@@ -41,9 +42,10 @@ interface IAccessAdmin is
     // grant/revoke/renounce role
     error ErrorRoleUnknown(RoleId roleId);
     error ErrorRoleIsLocked(RoleId roleId);
-    error ErrorRoleIsDisabled(RoleId roleId);
+    error ErrorRoleIsPaused(RoleId roleId);
     error ErrorRoleMembersLimitReached(RoleId roleId, uint256 memberCountLimit);
-    error ErrorRoleRemovalDisabled(RoleId roleId);
+    error ErrorRoleMemberNotContract(RoleId roleId, address notContract);
+    error ErrorRoleMemberRemovalDisabled(RoleId roleId, address expectedMember);
 
     // create target
     error ErrorTargetAlreadyCreated(address target, string name);
@@ -54,6 +56,7 @@ interface IAccessAdmin is
 
     // lock target
     error ErrorTagetNotLockable();
+    error ErrorTargetAlreadyLocked(address target, bool isLocked);
 
     // authorize target functions
     error ErrorAuthorizeForAdminRoleInvalid(address target);
@@ -104,6 +107,8 @@ interface IAccessAdmin is
 
     //--- view functions ----------------------------------------------------//
 
+    function getRelease() external view returns (VersionPart release);
+
     function roles() external view returns (uint256 numberOfRoles);
     function getRoleId(uint256 idx) external view returns (RoleId roleId);
     function getAdminRole() external view returns (RoleId roleId);

package/contracts/authorization/IAuthorization.sol

@@ -11,16 +11,18 @@ interface IAuthorization is
      IAccess 
 {
 
-     /// @dev Returns the release (VersionPart) for which the authorizations are defined by this contract.
-     /// Matches with the release returned by the linked service authorization.
-     function getRelease() external view returns(VersionPart release);
-
-     /// @dev Returns the list of involved roles.
-     function getRoles() external view returns(RoleId[] memory roles);
+     /// @dev Returns the list of service targets.
+     function getServiceDomains() external view returns(ObjectType[] memory serviceDomains);
 
      /// @dev Returns the service role for the specified service domain.
      function getServiceRole(ObjectType serviceDomain) external pure returns (RoleId serviceRoleId);
 
+     /// @dev Returns the service target for the specified domain.
+     function getServiceTarget(ObjectType serviceDomain) external view returns(Str serviceTarget);
+
+     /// @dev Returns the list of involved roles.
+     function getRoles() external view returns(RoleId[] memory roles);
+
      /// @dev Returns the name for the provided role id.
      function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory roleInfo);
 
@@ -33,7 +35,7 @@ interface IAuthorization is
      function getTargetName() external view returns (string memory name);
 
      /// @dev Returns the main target.
-     function getTarget() external view returns(Str target);
+     function getMainTarget() external view returns(Str target);
 
      /// @dev Returns the complete list of targets.
      function getTargets() external view returns(Str[] memory targets);
@@ -50,5 +52,9 @@ interface IAuthorization is
 
      /// @dev For the given target and role id the list of authorized functions is returned
      function getAuthorizedFunctions(Str target, RoleId roleId) external view returns(FunctionInfo[] memory authorizatedFunctions);
+
+     /// @dev Returns the release (VersionPart) for which the authorizations are defined by this contract.
+     /// Matches with the release returned by the linked service authorization.
+     function getRelease() external view returns(VersionPart release);
 }
 

package/contracts/authorization/IServiceAuthorization.sol

@@ -1,11 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
 import {IAccess} from "../authorization/IAccess.sol";
 import {ObjectType} from "../type/ObjectType.sol";
 import {VersionPart} from "../type/Version.sol";
 
-interface IServiceAuthorization {
+interface IServiceAuthorization is IERC165 {
 
      /// @dev Returns the commit hash representing the deployed release
      function getCommitHash()

package/contracts/authorization/ServiceAuthorization.sol

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
 import {IAccess} from "../authorization/IAccess.sol";
 import {ObjectType} from "../type/ObjectType.sol";
 import {IServiceAuthorization} from "./IServiceAuthorization.sol";
@@ -10,30 +12,36 @@ import {TimestampLib} from "../type/Timestamp.sol";
 import {VersionPart, VersionPartLib} from "../type/Version.sol";
 
 /// @dev Base contract for release specific service authorization contracts.
-contract ServiceAuthorization
-     is IServiceAuthorization
+contract ServiceAuthorization is 
+     IServiceAuthorization
 {
-     uint256 public constant GIF_VERSION_3 = 3;
+     uint256 public constant COMMIT_HASH_LENGTH = 40;
+     uint256 public constant GIF_INITIAL_VERSION = 3;
 
-     string private _commitHash;
+     uint256 public immutable VERSION;
+     string public COMMIT_HASH;
 
      ObjectType[] internal _serviceDomains;
      mapping(ObjectType domain => address service) internal _serviceAddress;
      mapping(ObjectType domain => ObjectType[] authorizedDomains) internal _authorizedDomains;
      mapping(ObjectType domain => mapping(ObjectType authorizedDomain => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
 
-     constructor(string memory commitHash) {
-          _commitHash = commitHash;
+     constructor(string memory commitHash, uint256 version) {
+          assert(bytes(commitHash).length == COMMIT_HASH_LENGTH);
+          assert(version >= GIF_INITIAL_VERSION);
+
+          COMMIT_HASH = commitHash;
+          VERSION = version;
           _setupDomains();
           _setupDomainAuthorizations();
      }
 
      function getCommitHash() external view returns(string memory commitHash) {
-          return _commitHash;
+          return COMMIT_HASH;
      }
 
      function getRelease() external view returns(VersionPart release) {
-          return VersionPartLib.toVersionPart(GIF_VERSION_3);
+          return VersionPartLib.toVersionPart(VERSION);
      }
 
      function getServiceDomains() external view returns(ObjectType[] memory serviceDomains) {
@@ -56,6 +64,15 @@ contract ServiceAuthorization
           return _authorizedFunctions[serviceDomain][authorizedDomain];
      }
 
+     // ERC165
+     function supportsInterface(bytes4 interfaceId) public pure returns (bool) {
+          return (
+               interfaceId == type(IServiceAuthorization).interfaceId || 
+               interfaceId == type(IERC165).interfaceId
+          );
+     }
+
+
      /// @dev Overwrite this function for a specific realease.
      function _setupDomains() internal virtual {}
 
@@ -86,5 +103,4 @@ contract ServiceAuthorization
                     name: StrLib.toStr(name),
                     createdAt: TimestampLib.blockTimestamp()}));
      }
-}
-
+}

package/contracts/distribution/BasicDistribution.sol

@@ -2,6 +2,7 @@
 pragma solidity ^0.8.20;
 
 import {Distribution} from "./Distribution.sol";
+import {DISTRIBUTOR} from "../type/ObjectType.sol";
 import {IAuthorization} from "../authorization/IAuthorization.sol";
 import {NftId} from "../type/NftId.sol";
 import {ReferralId} from "../type/Referral.sol";
@@ -43,8 +44,8 @@ contract BasicDistribution is
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
         returns (DistributorType distributorType)
     {
         return _createDistributorType(
@@ -66,24 +67,25 @@ contract BasicDistribution is
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
         returns(NftId distributorNftId)
     {
         return _createDistributor(distributor, distributorType, data);
     }
 
-    function updateDistributorType(
+    function changeDistributorType(
         NftId distributorNftId,
         DistributorType distributorType,
         bytes memory data
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
+        onlyNftOfType(distributorNftId, DISTRIBUTOR())
     {
-        _updateDistributorType(distributorNftId, distributorType, data);
+        _changeDistributorType(distributorNftId, distributorType, data);
     }
 
     /**
@@ -99,8 +101,8 @@ contract BasicDistribution is
     )
         external
         virtual
-        onlyDistributor()
         restricted()
+        onlyDistributor()
         returns (ReferralId referralId)
     {
         NftId distributorNftId = getDistributorNftId(msg.sender);
@@ -132,7 +134,6 @@ contract BasicDistribution is
             initialOwner, 
             name, 
             token, 
-            "", // registry data
             ""); // component specifc data
     }
 }