@etherisc/gif-next 0.0.2-d96b9e1-825 → 0.0.2-d9d5e42-801

package/contracts/authorization/Authorization.sol

@@ -0,0 +1,174 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IAccess} from "./IAccess.sol";
+import {IAuthorization} from "./IAuthorization.sol";
+
+import {ADMIN_ROLE_NAME, PUBLIC_ROLE_NAME} from "./AccessAdmin.sol";
+import {ObjectType, ObjectTypeLib} from "../type/ObjectType.sol";
+import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
+import {SelectorLib} from "../type/Selector.sol";
+import {ServiceAuthorization} from "../authorization/ServiceAuthorization.sol";
+import {Str, StrLib} from "../type/String.sol";
+import {TimestampLib} from "../type/Timestamp.sol";
+import {VersionPart, VersionPartLib} from "../type/Version.sol";
+
+
+contract Authorization is
+    ServiceAuthorization,
+    IAuthorization
+{
+
+    // MUST match with AccessAdminLib.COMPONENT_ROLE_MIN
+    uint64 public constant COMPONENT_ROLE_MIN = 110000;
+
+    uint64 internal _nextGifContractRoleId;
+
+    string internal _tokenHandlerName = "ComponentTh";
+    Str internal _tokenHandlerTarget;
+
+
+    constructor(
+        string memory mainTargetName, 
+        ObjectType domain,
+        uint8 release,
+        string memory commitHash,
+        bool isComponent,
+        bool includeTokenHandler
+    )
+        ServiceAuthorization(mainTargetName, domain, release, commitHash)
+    {
+        _nextGifContractRoleId = 10;
+
+        // setup main target
+        if (isComponent) {
+            if (domain.eqz()) {
+                revert ErrorAuthorizationTargetDomainZero();
+            }
+
+            RoleId mainRoleId = RoleIdLib.toRoleId(COMPONENT_ROLE_MIN);
+            string memory mainRolName = _toTargetRoleName(_mainTargetName);
+
+            _addTargetWithRole(
+                _mainTargetName, 
+                mainRoleId,
+                mainRolName);
+        } else {
+            _addGifTarget(_mainTargetName);
+        }
+
+        // setup use case specific parts
+        _setupServiceTargets();
+        _setupRoles(); // not including main target role
+        _setupTargets(); // not including main target (and token handler target)
+        _setupTargetAuthorizations(); // not including token handler target
+
+        // setup component token handler 
+        if (includeTokenHandler) {
+            _tokenHandlerName = string(abi.encodePacked(mainTargetName, "Th"));
+            _tokenHandlerTarget = StrLib.toStr(_tokenHandlerName);
+            _addTarget(_tokenHandlerName);
+            _setupTokenHandlerAuthorizations();
+        }
+
+        _registerInterfaceNotInitializing(type(IAuthorization).interfaceId);
+    }
+
+
+    function getTokenHandlerName() public view returns(string memory) {
+        return _tokenHandlerName;
+    }
+
+    function getTokenHandlerTarget() public view returns(Str) {
+        return _tokenHandlerTarget;
+    }
+
+    function getTarget(string memory targetName) public pure returns(Str target) {
+        return StrLib.toStr(targetName);
+    }
+
+    function getTargets() external view returns(Str[] memory targets) {
+        return _targets;
+    }
+
+    function targetExists(Str target) external view returns(bool exists) {
+        return target == _mainTarget || _targetExists[target];
+    }
+
+    /// @dev Sets up the relevant service targets for the component.
+    /// Overwrite this function for use case specific authorizations.
+    // solhint-disable-next-line no-empty-blocks
+    function _setupServiceTargets() internal virtual { }
+
+    /// @dev Sets up the relevant (non-service) targets for the component.
+    /// Overwrite this function for use case specific authorizations.
+    // solhint-disable-next-line no-empty-blocks
+    function _setupTargets() internal virtual { }
+
+    /// @dev Sets up the relevant roles for the component.
+    /// Overwrite this function for use case specific authorizations.
+    // solhint-disable-next-line no-empty-blocks
+    function _setupRoles() internal virtual {}
+
+    /// @dev Sets up the relevant component's token handler authorizations.
+    /// Overwrite this function for use case specific authorizations.
+    // solhint-disable-next-line no-empty-blocks
+    function _setupTokenHandlerAuthorizations() internal virtual {}
+
+    /// @dev Sets up the relevant target authorizations for the component.
+    /// Overwrite this function for use case specific authorizations.
+    // solhint-disable-next-line no-empty-blocks
+    function _setupTargetAuthorizations() internal virtual {}
+
+
+    /// @dev Add a contract role for the provided role id and name.
+    function _addCustomRole(RoleId roleId, RoleId adminRoleId, uint32 maxMemberCount, string memory name) internal {
+        _addRole(
+            roleId,
+            _toRoleInfo(
+                adminRoleId,
+                RoleType.Custom,
+                maxMemberCount,
+                name));
+    }
+
+    /// @dev Add a gif target with its corresponding contract role
+    function _addGifTarget(string memory contractName) internal {
+        RoleId contractRoleId = RoleIdLib.toRoleId(_nextGifContractRoleId++);
+        string memory contractRoleName = string(
+            abi.encodePacked(
+                contractName,
+                ROLE_NAME_SUFFIX));
+
+        _addTargetWithRole(
+            contractName,
+            contractRoleId,
+            contractRoleName);
+    }
+
+
+    /// @dev Use this method to to add an authorized target.
+    function _addTarget(string memory name) internal {
+        _addTargetWithRole(name, RoleIdLib.zero(), "");
+    }
+
+
+    /// @dev Role id for targets registry, staking and instance
+    function _toTargetRoleId(ObjectType targetDomain) 
+        internal
+        pure
+        returns (RoleId targetRoleId)
+    {
+        return RoleIdLib.toRoleId(100 * targetDomain.toInt());
+    }
+
+
+    /// @dev Returns the role name for the specified target name
+    function _toTargetRoleName(string memory targetName) internal pure returns (string memory) {
+        return string(
+            abi.encodePacked(
+                targetName,
+                ROLE_NAME_SUFFIX));
+    }
+}
+

package/contracts/authorization/IAccess.sol

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import {RoleId} from "../type/RoleId.sol";
+import {Selector} from "../type/Selector.sol";
+import {Str} from "../type/String.sol";
+import {Timestamp} from "../type/Timestamp.sol";
+
+interface IAccess {
+
+    enum RoleType {
+        Undefined, // no role must have this type
+        Core, // GIF core roles
+        Contract, // roles assigned to contracts, cannot be revoked
+        Custom // use case specific rules for components
+    }
+
+    enum TargetType {
+        Undefined, // no target must have this type
+        Core, // GIF core contracts
+        GenericService, // release independent service contracts
+        Service, // service contracts
+        Instance, // instance contracts
+        Component, // instance contracts
+        Custom // use case specific rules for components
+    }
+
+    struct RoleInfo {
+        // slot 0
+        RoleId adminRoleId; 
+        RoleType roleType; 
+        uint32 maxMemberCount; 
+        Timestamp createdAt; 
+        Timestamp pausedAt; 
+        // slot 1
+        Str name;
+    }
+
+    // TODO recalc slot allocation
+    struct TargetInfo {
+        Str name;
+        TargetType targetType;
+        RoleId roleId;
+        Timestamp createdAt;
+    }
+
+    struct FunctionInfo {
+        // slot 0
+        Str name; // function name
+        // slot 1
+        Selector selector; // function selector
+        Timestamp createdAt;
+    }
+
+    struct RoleNameInfo {
+        // slot 0
+        RoleId roleId;
+        bool exists;
+    }
+
+    struct TargeNameInfo {
+        // slot 0
+        address target;
+        bool exists;
+    }
+
+}

package/contracts/authorization/IAccessAdmin.sol

@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
+
+import {IAccess} from "./IAccess.sol";
+import {IAuthorization} from "./IAuthorization.sol";
+import {IRegistryLinked} from "../shared/IRegistryLinked.sol";
+import {IRelease} from "../registry/IRelease.sol";
+
+import {NftId} from "../type/NftId.sol";
+import {ObjectType} from "../type/ObjectType.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {Str} from "../type/String.sol";
+import {VersionPart} from "../type/Version.sol";
+
+/// @dev Base interface for registry admin, release admin, and instance admin 
+interface IAccessAdmin is 
+    IAccessManaged,
+    IAccess,
+    IRegistryLinked,
+    IRelease
+{
+
+    // roles, targets and functions
+    event LogAccessAdminRoleCreated(string admin, RoleId roleId, RoleType roleType, RoleId roleAdminId, string name);
+    event LogAccessAdminTargetCreated(string admin, string name, bool managed, address target, RoleId roleId);
+
+    event LogAccessAdminRoleGranted(string admin, address account, string roleName);
+    event LogAccessAdminRoleRevoked(string admin, address account, string roleName);
+    event LogAccessAdminFunctionGranted(string admin, address target, string func);
+
+    // only deployer modifier
+    error ErrorAccessAdminNotDeployer();
+
+    // only role admin modifier
+    error ErrorAccessAdminNotAdminOfRole(RoleId adminRoleId, address account);
+
+    // only role owner modifier
+    error ErrorAccessAdminNotRoleOwner(RoleId roleId, address account);
+
+    // role management
+    error ErrorAccessAdminInvalidUserOfAdminRole();
+    error ErrorAccessAdminInvalidUserOfPublicRole();
+    error ErrorAccessAdminRoleNotCustom(RoleId roleId);
+
+    // initialization
+    error ErrorAccessAdminNotRegistry(address registry);
+    error ErrorAccessAdminAuthorityNotContract(address authority);
+    error ErrorAccessAdminAccessManagerNotAccessManager(address authority);
+    error ErrorAccessAdminAccessManagerEmptyName();
+
+    // check target
+    error ErrorAccessAdminInvalidTargetType(address target, TargetType targetType);
+    error ErrorAccessAdminInvalidServiceType(address target, TargetType serviceTargetType);
+    error ErrorAccessAdminTargetNotCreated(address target);
+    error ErrorAccessAdminTargetNotRegistered(address target);
+    error ErrorAccessAdminTargetTypeMismatch(address target, ObjectType expectedType, ObjectType actualType);
+
+    // check authorization
+    error ErrorAccessAdminAlreadyInitialized(address authorization);
+    error ErrorAccessAdminNotAuthorization(address authorization);
+    error ErrorAccessAdminNotServiceAuthorization(address serviceAuthorization);
+    error ErrorAccessAdminDomainMismatch(address authorization, ObjectType expectedDomain, ObjectType actualDomain);
+    error ErrorAccessAdminReleaseMismatch(address authorization, VersionPart expectedRelease, VersionPart actualRelease);
+
+    // link to nft
+    error ErrorAccessAdminNotRegistered(address registerable);
+
+    // initialize authority
+    error ErrorAccessAdminAdminRoleMissing();
+
+    // create role
+    error ErrorAccessAdminRoleAlreadyCreated(RoleId roleId, string name);
+    error ErrorAccessAdminRoleAdminNotExisting(RoleId adminRoleId);
+    error ErrorAccessAdminRoleNameEmpty(RoleId roleId);
+    error ErrorAccessAdminRoleNameAlreadyExists(RoleId roleId, string name, RoleId existingRoleId);
+
+    // grant/revoke/renounce role
+    error ErrorAccessAdminRoleUnknown(RoleId roleId);
+    error ErrorAccessAdminRoleIsLocked(RoleId roleId);
+    error ErrorAccessAdminRoleIsPaused(RoleId roleId);
+    error ErrorAccessAdminRoleMembersLimitReached(RoleId roleId, uint256 memberCountLimit);
+    error ErrorAccessAdminRoleMemberNotContract(RoleId roleId, address notContract);
+    error ErrorAccessAdminRoleMemberRemovalDisabled(RoleId roleId, address expectedMember);
+
+    // create target
+    error ErrorAccessAdminTargetAlreadyCreated(address target, string name);
+    error ErrorAccessAdminTargetNameEmpty(address target);
+    error ErrorAccessAdminTargetNameAlreadyExists(address target, string name, address existingTarget);
+    error ErrorAccessAdminTargetNotAccessManaged(address target);
+    error ErrorAccessAdminTargetAuthorityMismatch(address expectedAuthority, address actualAuthority);
+
+    // lock target
+    error ErrorAccessAdminTagetNotLockable();
+    error ErrorAccessAdminTargetAlreadyLocked(address target, bool isLocked);
+
+    // authorize target functions
+    error ErrorAccessAdminAuthorizeForAdminRoleInvalid(address target);
+
+    // toFunction
+    error ErrorAccessAdminSelectorZero();
+    error ErrorAccessAdminFunctionNameEmpty();
+
+    // check target
+    error ErrorAccessAdminTargetUnknown(address target);
+
+    //--- view functions ----------------------------------------------------//
+
+    function getAuthorization() external view returns (IAuthorization authorization);
+    function getLinkedNftId() external view returns (NftId linkedNftId);
+    function getLinkedOwner() external view returns (address linkedOwner);
+
+    function isLocked() external view returns (bool locked);
+
+    function roles() external view returns (uint256 numberOfRoles);
+    function getRoleId(uint256 idx) external view returns (RoleId roleId);
+    function getAdminRole() external view returns (RoleId roleId);
+    function getPublicRole() external view returns (RoleId roleId);
+
+    function roleExists(RoleId roleId) external view returns (bool exists); 
+    function roleExists(string memory roleName) external view returns (bool exists); 
+    function getRoleForName(string memory name) external view returns (RoleId roleId);
+    function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory roleInfo);
+    function isRoleActive(RoleId roleId) external view returns (bool isActive);
+    function isRoleCustom(RoleId roleId) external view returns (bool isCustom);
+
+    function isRoleMember(RoleId roleId, address account) external view returns (bool);
+    function isRoleAdmin(RoleId roleId, address account) external view returns (bool);
+    function roleMembers(RoleId roleId) external view returns (uint256 numberOfMembers);
+    function getRoleMember(RoleId roleId, uint256 idx) external view returns (address account);
+
+    function targetExists(address target) external view returns (bool exists);
+    function getTargetForName(Str name) external view returns (address target);
+    function targets() external view returns (uint256 numberOfTargets);
+    function getTargetAddress(uint256 idx) external view returns (address target);
+    function getTargetInfo(address target) external view returns (TargetInfo memory targetInfo);
+    function isTargetLocked(address target) external view returns (bool locked);
+
+    function authorizedFunctions(address target) external view returns (uint256 numberOfFunctions);
+    function getAuthorizedFunction(address target, uint256 idx) external view returns (FunctionInfo memory func, RoleId roleId);
+
+    function deployer() external view returns (address);
+}

package/contracts/authorization/IAuthorization.sol

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IServiceAuthorization} from "./IServiceAuthorization.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {Str} from "../type/String.sol";
+
+
+interface IAuthorization is 
+     IServiceAuthorization
+{
+
+     /// @dev Returns the token hander name.
+     /// Only components have a token handler.
+     function getTokenHandlerName() external view returns(string memory name);
+
+     /// @dev Returns the token hander target.
+     /// Only components have a token handler.
+     function getTokenHandlerTarget() external view returns(Str target);
+
+     /// @dev Returns the complete list of targets.
+     function getTargets() external view returns(Str[] memory targets);
+
+     /// @dev Returns true iff the specified target exists.
+     function targetExists(Str target) external view returns(bool exists);
+}
+

package/contracts/authorization/IServiceAuthorization.sol

@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
+import {IAccess} from "../authorization/IAccess.sol";
+import {ObjectType} from "../type/ObjectType.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {Str} from "../type/String.sol";
+import {VersionPart} from "../type/Version.sol";
+
+interface IServiceAuthorization is 
+     IERC165, 
+     IAccess
+{
+
+     error ErrorAuthorizationMainTargetNameEmpty();
+     error ErrorAuthorizationTargetDomainZero();
+     error ErrorAuthorizationReleaseInvalid(uint8 release);
+     error ErrorAuthorizationCommitHashInvalid(string commitHash);
+
+     /// @dev Returns the main domain of the authorization.
+     function getDomain() external view returns(ObjectType targetDomain);
+
+     /// @dev Returns the release (VersionPart) for which the authorizations are defined by this contract.
+     /// Matches with the release returned by the linked service authorization.
+     function getRelease() external view returns(VersionPart release);
+
+     /// @dev Returns the commit hash for the related GIF release.
+     function getCommitHash() external view returns(string memory commitHash);
+
+     /// @dev Returns the main target id name as string.
+     /// This name is used to derive the target id and a corresponding target role name
+     /// Overwrite this function to change the basic pool target name.
+     function getMainTargetName() external view returns (string memory name);
+
+     /// @dev Returns the main target.
+     function getMainTarget() external view returns(Str target);
+
+     /// @dev Returns the full list of service domains for this release.
+     /// Services need to be registered for the release in revers order of this list.
+     function getServiceDomains() external view returns(ObjectType[] memory serviceDomains);
+
+     /// @dev Returns the service domain for the provided index.
+     function getServiceDomain(uint256 idx) external view returns(ObjectType serviceDomain);
+
+     /// @dev Returns the service target for the specified domain.
+     function getServiceTarget(ObjectType serviceDomain) external view returns(Str serviceTarget);
+
+     /// @dev Returns the service target for the specified domain.
+     function getServiceRole(ObjectType serviceDomain) external view returns(RoleId serviceRoleId);
+
+     /// @dev Returns the expected service address for the provided domain.
+     function getServiceAddress(ObjectType serviceDomain) external view returns(address service);
+
+     /// @dev Returns the role id associated with the target.
+     /// If no role is associated with the target the zero role id is returned.
+     function getTargetRole(Str target) external view returns(RoleId roleId);
+
+     /// @dev Returns true iff the role exists.
+     function roleExists(RoleId roleId) external view returns(bool exists);
+
+     /// @dev Returns the list of involved roles.
+     function getRoles() external view returns(RoleId[] memory roles);
+
+     /// @dev Returns the role info for the provided role id.
+     function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory roleInfo);
+
+     /// @dev Returns the name for the provided role id.
+     function getRoleName(RoleId roleId) external view returns (string memory roleName);
+
+     /// @dev For the given target the list of authorized role ids is returned
+     function getAuthorizedRoles(Str target) external view returns(RoleId[] memory roleIds);
+
+     /// @dev For the given target and role id the list of authorized functions is returned
+     function getAuthorizedFunctions(Str target, RoleId roleId) external view returns(FunctionInfo[] memory authorizatedFunctions);
+}
+