@etherisc/gif-next 0.0.2-d5522f6-712 → 0.0.2-d59d51e-694

package/contracts/registry/RegistryAccessManager.sol

@@ -1,101 +1,85 @@
 // SPDX-License-Identifier: UNLICENSED
 pragma solidity ^0.8.20;
 
-import {AccessManager} from "@openzeppelin/contracts/access/manager/AccessManager.sol";
 import {AccessManaged} from "@openzeppelin/contracts/access/manager/AccessManaged.sol";
+import {AccessManager} from "@openzeppelin/contracts/access/manager/AccessManager.sol";
+import {AuthorityUtils} from "@openzeppelin/contracts/access/manager/AuthorityUtils.sol";
 
-import {RoleId, RoleIdLib,
-        REGISTRY_SERVICE_MANAGER_ROLE,
-        REGISTRY_SERVICE_ADMIN_ROLE,
-        RELEASE_MANAGER_ROLE} from "../types/RoleId.sol";
-
-import {TokenRegistry} from "./TokenRegistry.sol";
+import {AccessManagerUpgradeableInitializeable} from "../shared/AccessManagerUpgradeableInitializeable.sol";
 import {ReleaseManager} from "./ReleaseManager.sol";
+import {RoleId, RoleIdLib, GIF_MANAGER_ROLE, GIF_ADMIN_ROLE} from "../type/RoleId.sol";
+import {TokenRegistry} from "./TokenRegistry.sol";
 
 /*
-    3 types of roles: 
-    1) REGISTRAR roles 
-        - each one is unique
-        - always have 1 member
-        - one role is set for each function of each version of registry service
-    2) REGISTRY_SERVICE_MANAGER_ROLE aka GIF_MANAGER_ROLE
+    1) GIF_MANAGER_ROLE
         - can have arbitrary number of members
         - responsible for services registrations
         - responsible for token registration and activation
-    3) REGISTRY_SERVICE_ADMIN_ROLE aka GIF_ADMIN_ROLE
-        - admin of REGISTRY_SERVICE_MANAGER_ROLE
+
+    2) GIF_ADMIN_ROLE
+        - admin of GIF_MANAGER_ROLE
         - MUST have 1 member at any time
         - granted/revoked ONLY in transferAdminRole() -> consider lock out situations!!!
-        - responsible for release manager initialization
-        - responsible for creation and activation of each release
-
+        - responsible for creation and activation of releases
 */
 
-contract RegistryAccessManager is AccessManaged
+// grants GIF_ADMIN_ROLE to registry owner as registryOwner is transaction sender
+// grants GIF_MANAGER_ROLE to registry owner via contructor argument
+contract RegistryAccessManager is
+    AccessManaged
 {
-    error NotInitialized();
-    error AlreadyInitialized();
-
     uint64 public constant UNIQUE_ROLE_ID_MIN = 1000000;
     
-    AccessManager private immutable _accessManager;
     address private _releaseManager;
-    address private _tokenRegistry;
-
     uint64 private _idNext; // role id
-    bool private _isInitialized;
-
-    modifier onlyOnce() {
-        if(_isInitialized) {
-            revert AlreadyInitialized();
-        } 
-        _;
-        _isInitialized = true;
-    }
 
-    modifier onlyInitialized() {
-        if(!_isInitialized) {
-            revert NotInitialized();
-        }
-        _;
-    }
 
-    constructor(address manager)
+    // IMPORTNAT: this.authority() must be valid before initialize() function....
+    // -> have constructor and initializer function
+    constructor(
+        address gifAdmin,
+        address gifManager
+    )
         AccessManaged(msg.sender)
     {
-        _accessManager = new AccessManager(address(this));
-        setAuthority(address(_accessManager));
+        _releaseManager = msg.sender;
 
-        _idNext = UNIQUE_ROLE_ID_MIN;
+        AccessManagerUpgradeableInitializeable accessManager = new AccessManagerUpgradeableInitializeable();
+        accessManager.initialize(address(this));
+        setAuthority(address(accessManager));
 
-        _configureAdminRoleInitial();
+        _idNext = UNIQUE_ROLE_ID_MIN;
 
-        address admin = msg.sender;
-        _grantRole(REGISTRY_SERVICE_ADMIN_ROLE(), admin, 0);
-        _grantRole(REGISTRY_SERVICE_MANAGER_ROLE(), manager, 0);
-    }
+        _setAdminRole();
+        _setManagerRole();
 
-    function initialize(address releaseManager, address tokenRegistry)
-        external 
-        restricted // GIF_ADMIN_ROLE
-        onlyOnce
-    {
-        require(
-            ReleaseManager(releaseManager).authority() == address(_accessManager),
-            "RegistryAccessManager: release manager authority is invalid");
-        require(tokenRegistry > address(0), "RegistryAccessManager: token registry is 0");
-        //require(tokenRegistry.authority() == address(_accessManager));
+        _grantRole(GIF_ADMIN_ROLE(), gifAdmin, 0);
+        _grantRole(GIF_MANAGER_ROLE(), gifManager, 0);
 
-        _releaseManager = releaseManager;
-        _tokenRegistry = tokenRegistry;
+        // set gif manager role admin
+        _setRoleAdmin(GIF_MANAGER_ROLE(), GIF_ADMIN_ROLE());
+    }
 
-        _configureAdminRole();
-        _configureManagerRole();
-        _configureReleaseManagerRole();
 
-        _grantRole(RELEASE_MANAGER_ROLE(), releaseManager, 0);
+    function setTokenRegistry(
+        address tokenRegistry    
+    )
+        external
+        restricted() // GIF_ADMIN_ROLE
+    {
+        // for TokenRegistry
+        bytes4[] memory functionSelector = new bytes4[](5);
+        functionSelector[0] = TokenRegistry.registerToken.selector;
+        functionSelector[1] = TokenRegistry.registerRemoteToken.selector;
+        functionSelector[2] = TokenRegistry.setActive.selector;
+        functionSelector[3] = TokenRegistry.setActiveForVersion.selector;
+
+        // only needed for testing TODO find a better way
+        functionSelector[4] = TokenRegistry.setActiveWithVersionCheck.selector;
+        _setTargetFunctionRole(address(tokenRegistry), functionSelector, GIF_MANAGER_ROLE());
     }
 
+
     // set unique role for target, role forever have 1 member and never revoked
     function setAndGrantUniqueRole(
         address account, 
@@ -104,104 +88,106 @@ contract RegistryAccessManager is AccessManaged
     )
         external
         restricted // RELEASE_MANAGER_ROLE
-        onlyInitialized
         returns(RoleId)
     {
-        // TODO questionable check...
-        // target is not part of `runtime`
-        //if(
-        //    target == address(this) ||
-        //    target == address(_accessManager) || 
-        //    target == _releaseManager || 
-        //    target == _tokenRegistry)
-        //{ return TargetInvalid(); }
-
+        // TODO define and add checks
         RoleId roleId = _getNextRoleId();
 
         _setTargetFunctionRole(target, selector, roleId);
         _grantRole(roleId, account, 0);
     }
 
+    function setTargetFunctionRole(
+        address target, 
+        bytes4[] memory selector,
+        RoleId roleId
+    )
+        external
+        restricted // RELEASE_MANAGER_ROLE
+    {
+        _setTargetFunctionRole(target, selector, roleId);
+    }
+
     /*function transferAdmin(address to)
         external
-        restricted // only with REGISTRY_SERVICE_ADMIN_ROLE or nft owner
+        restricted // only with GIF_ADMIN_ROLE or nft owner
     {
-        _accessManager.revoke(REGISTRY_SERVICE_ADMIN_ROLE, );
-        _accesssManager.grant(REGISTRY_SERVICE_ADMIN_ROLE, to, 0);
+        _accessManager.revoke(GIF_ADMIN_ROLE, );
+        _accesssManager.grant(GIF_ADMIN_ROLE, to, 0);
     }*/
 
     //--- view functions ----------------------------------------------------//
 
-    function getAccessManager()
+    function hasRole(
+        address account,
+        RoleId roleId
+    )
         external
         view
-        returns (AccessManager)
+        returns(bool)
     {
-        return _accessManager;
+        (bool isMember, ) = AccessManager(authority()).hasRole(roleId.toInt(), account);
+        return isMember;
     }
 
-    //--- private functions -------------------------------------------------//
 
-    function _configureAdminRoleInitial() private
+    function canCall(
+        address account,
+        address target,
+        bytes4 functionSelector
+    )
+        external
+        view
+        returns(bool)
     {
-        bytes4[] memory functionSelector = new bytes4[](1);
+        (bool immediate,) = AuthorityUtils.canCallWithDelay(
+            authority(),
+            account,
+            target,
+            functionSelector);
 
-        functionSelector[0] = RegistryAccessManager.initialize.selector;
-        _setTargetFunctionRole(address(this), functionSelector, REGISTRY_SERVICE_ADMIN_ROLE());
+        return immediate;
     }
 
-    function _configureAdminRole() private
+    //--- private functions -------------------------------------------------//
+
+    function _setAdminRole() private
     {
+        // for this contract
         bytes4[] memory functionSelector = new bytes4[](1);
+        functionSelector[0] = RegistryAccessManager.setTokenRegistry.selector;
 
-        // for RegistryServiceProxyManager
-        // TODO upgrading with releaseManager.upgrade()->proxy.upgrade()???
-        //functionSelector[0] = RegistryServiceManager.upgrade.selector;
-        //_setTargetFunctionRole(address(this), functionSelector, REGISTRY_SERVICE_ADMIN_ROLE());
-
-        // for TokenRegistry
+        _setTargetFunctionRole(address(this), functionSelector, GIF_ADMIN_ROLE());
 
         // for ReleaseManager
-        functionSelector[0] = ReleaseManager.createNextRelease.selector;
-        _setTargetFunctionRole(_releaseManager, functionSelector, REGISTRY_SERVICE_ADMIN_ROLE());
-        //functionSelector[0] = ReleaseManager.activateNextRelease.selector;
-        //_setTargetFunctionRole(_releaseManager, functionSelector, REGISTRY_SERVICE_ADMIN_ROLE());
+        bytes4[] memory functionSelector2 = new bytes4[](3);
+        functionSelector2[0] = ReleaseManager.registerStaking.selector;
+        functionSelector2[1] = ReleaseManager.createNextRelease.selector;
+        functionSelector2[2] = ReleaseManager.activateNextRelease.selector;
+
+        _setTargetFunctionRole(_releaseManager, functionSelector2, GIF_ADMIN_ROLE());
     }
     
-    function _configureManagerRole() private 
+    function _setManagerRole() private 
     {
-        bytes4[] memory functionSelector = new bytes4[](1);
-
-        // for TokenRegistry
-        functionSelector[0] = TokenRegistry.setActive.selector;
-        _setTargetFunctionRole(address(_tokenRegistry), functionSelector, REGISTRY_SERVICE_MANAGER_ROLE());
-
         // for ReleaseManager
-        functionSelector[0] = ReleaseManager.registerService.selector;
-        _setTargetFunctionRole(_releaseManager, functionSelector, REGISTRY_SERVICE_MANAGER_ROLE());
-
-        // set admin
-        _setRoleAdmin(REGISTRY_SERVICE_MANAGER_ROLE(), REGISTRY_SERVICE_ADMIN_ROLE());
+        bytes4[] memory functionSelector = new bytes4[](2);
+        functionSelector[0] = ReleaseManager.registerService.selector; // for ReleaseManager
+        functionSelector[1] = ReleaseManager.prepareNextRelease.selector;
+        _setTargetFunctionRole(_releaseManager, functionSelector, GIF_MANAGER_ROLE());
     }
 
-    function _configureReleaseManagerRole() private
-    {
-        bytes4[] memory functionSelector = new bytes4[](1);
-
-        functionSelector[0] = RegistryAccessManager.setAndGrantUniqueRole.selector;
-        _setTargetFunctionRole(address(this), functionSelector, RELEASE_MANAGER_ROLE());
-    }
 
     function _setTargetFunctionRole(address target, bytes4[] memory selectors, RoleId roleId) private {
-        _accessManager.setTargetFunctionRole(target, selectors, roleId.toInt());        
+        AccessManager(authority()).setTargetFunctionRole(target, selectors, roleId.toInt());        
     }
 
     function _setRoleAdmin(RoleId roleId, RoleId adminRoleId) private {
-        _accessManager.setRoleAdmin(roleId.toInt(), adminRoleId.toInt());
+        AccessManager(authority()).setRoleAdmin(roleId.toInt(), adminRoleId.toInt());
     }
 
     function _grantRole(RoleId roleId, address account, uint32 executionDelay) private {
-            _accessManager.grantRole(roleId.toInt(), account, executionDelay);
+        AccessManager(authority()).grantRole(roleId.toInt(), account, executionDelay);
     }
 
     function _getNextRoleId() private returns(RoleId roleId) {