@etherisc/gif-next 0.0.2-e818783-565 → 0.0.2-e8b06c8-540

package/contracts/instance/InstanceAuthorizationV3.sol

@@ -0,0 +1,213 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {
+     PRODUCT, ORACLE, POOL, INSTANCE, COMPONENT, DISTRIBUTION, APPLICATION, POLICY, CLAIM, BUNDLE
+} from "../../contracts/type/ObjectType.sol";
+
+import {
+     ADMIN_ROLE, DISTRIBUTION_OWNER_ROLE, ORACLE_OWNER_ROLE, POOL_OWNER_ROLE, PRODUCT_OWNER_ROLE
+} from "../../contracts/type/RoleId.sol";
+
+import {BundleManager} from "../instance/BundleManager.sol"; 
+import {IAccess} from "../authorization/IAccess.sol";
+import {Instance} from "../instance/Instance.sol";
+import {InstanceAdminNew} from "../instance/InstanceAdminNew.sol";
+import {InstanceStore} from "../instance/InstanceStore.sol";
+import {ModuleAuthorization} from "../authorization/ModuleAuthorization.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {VersionPart, VersionPartLib} from "../type/Version.sol";
+
+
+contract InstanceAuthorizationV3
+     is ModuleAuthorization
+{
+
+     string public constant INSTANCE_TARGET_NAME = "Instance";
+     string public constant INSTANCE_STORE_TARGET_NAME = "InstanceStore";
+     string public constant INSTANCE_ADMIN_TARGET_NAME = "InstanceAdmin";
+     string public constant BUNDLE_MANAGER_TARGET_NAME = "BundleManager";
+
+     string public constant INSTANCE_ROLE_NAME = "InstanceRole";
+     string public constant DISTRIBUTION_OWNER_ROLE_NAME = "DistributionOwnerRole";
+     string public constant ORACLE_OWNER_ROLE_NAME = "OracleOwnerRole";
+     string public constant POOL_OWNER_ROLE_NAME = "PoolOwnerRole";
+     string public constant PRODUCT_OWNER_ROLE_NAME = "ProductOwnerRole";
+
+     constructor() ModuleAuthorization(INSTANCE_TARGET_NAME) {}
+
+
+     function _setupRoles()
+          internal
+          override
+     {
+          _addGifRole(DISTRIBUTION_OWNER_ROLE(), DISTRIBUTION_OWNER_ROLE_NAME);
+          _addGifRole(ORACLE_OWNER_ROLE(), ORACLE_OWNER_ROLE_NAME);
+          _addGifRole(POOL_OWNER_ROLE(), POOL_OWNER_ROLE_NAME);
+          _addGifRole(PRODUCT_OWNER_ROLE(), PRODUCT_OWNER_ROLE_NAME);
+     }
+
+
+     function _setupTargets()
+          internal
+          override
+     {
+          // instance target
+          _addTargetWithRole(
+               INSTANCE_TARGET_NAME, 
+               _getTargetRoleId(INSTANCE()),
+               INSTANCE_ROLE_NAME);
+
+          // instance supporting targets
+          _addTarget(INSTANCE_STORE_TARGET_NAME);
+          _addTarget(INSTANCE_ADMIN_TARGET_NAME);
+          _addTarget(BUNDLE_MANAGER_TARGET_NAME);
+
+          // service targets relevant to instance
+          _addServiceTargetWithRole(INSTANCE());
+          _addServiceTargetWithRole(COMPONENT());
+          _addServiceTargetWithRole(DISTRIBUTION());
+          _addServiceTargetWithRole(ORACLE());
+          _addServiceTargetWithRole(POOL());
+          _addServiceTargetWithRole(BUNDLE());
+          _addServiceTargetWithRole(PRODUCT());
+          _addServiceTargetWithRole(APPLICATION());
+          _addServiceTargetWithRole(POLICY());
+          _addServiceTargetWithRole(CLAIM());
+     }
+
+
+     function _setupTargetAuthorizations()
+          internal
+          override
+     {
+          _setupInstanceAuthorization();
+          _setupInstanceAdminAuthorization();
+          _setupInstanceStoreAuthorization();
+          _setupBundleManagerAuthorization();
+     }
+
+
+     function _setupBundleManagerAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          // authorize bundle service role
+          functions = _authorizeForTarget(BUNDLE_MANAGER_TARGET_NAME, getServiceRole(BUNDLE()));
+          _authorize(functions, BundleManager.linkPolicy.selector, "linkPolicy");
+          _authorize(functions, BundleManager.unlinkPolicy.selector, "unlinkPolicy");
+          _authorize(functions, BundleManager.add.selector, "add");
+          _authorize(functions, BundleManager.lock.selector, "lock");
+          _authorize(functions, BundleManager.unlock.selector, "unlock");
+     }
+
+
+     function _setupInstanceAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          // TODO cleanup
+          // authorize instance service role
+          functions = _authorizeForTarget(INSTANCE_TARGET_NAME, getServiceRole(INSTANCE()));
+          // _authorize(functions, Instance.setInstanceAdmin.selector, "setInstanceAdmin");
+          // _authorize(functions, Instance.setInstanceStore.selector, "setInstanceStore");
+          // _authorize(functions, Instance.setBundleManager.selector, "setBundleManager");
+          _authorize(functions, Instance.setInstanceReader.selector, "setInstanceReader");
+     }
+
+
+     function _setupInstanceAdminAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          // authorize instance role
+          functions = _authorizeForTarget(INSTANCE_ADMIN_TARGET_NAME, _getTargetRoleId(INSTANCE()));
+          // _authorize(functions, InstanceAdminNew.createRole.selector, "createRole");
+          _authorize(functions, InstanceAdminNew.grantRole.selector, "grantRole");
+          // _authorize(functions, InstanceAdminNew.createTarget.selector, "createTarget");
+          // _authorize(functions, InstanceAdminNew.setTargetFunctionRoleByInstance.selector, "setTargetFunctionRoleByInstance");
+          // _authorize(functions, InstanceAdminNew.setTargetLockedByInstance.selector, "setTargetLockedByInstance");
+
+          // authorize instance service role
+          functions = _authorizeForTarget(INSTANCE_ADMIN_TARGET_NAME, getServiceRole(INSTANCE()));
+          // _authorize(functions, InstanceAdminNew.createGifTarget.selector, "createGifTarget");
+          // _authorize(functions, InstanceAdminNew.setTargetLockedByService.selector, "setTargetLockedByService");
+          // _authorize(functions, InstanceAdminNew.setTargetFunctionRoleByService.selector, "setTargetFunctionRoleByService");
+     }
+
+
+     function _setupInstanceStoreAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          // authorize component service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(COMPONENT()));
+          _authorize(functions, InstanceStore.createComponent.selector, "createComponent");
+          _authorize(functions, InstanceStore.updateComponent.selector, "updateComponent");
+          _authorize(functions, InstanceStore.createPool.selector, "createPool");
+          _authorize(functions, InstanceStore.createProduct.selector, "createProduct");
+          _authorize(functions, InstanceStore.updateProduct.selector, "updateProduct");
+          _authorize(functions, InstanceStore.increaseBalance.selector, "increaseBalance");
+          _authorize(functions, InstanceStore.increaseFees.selector, "increaseFees");
+
+          // authorize distribution service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(DISTRIBUTION()));
+          _authorize(functions, InstanceStore.createDistributorType.selector, "createDistributorType");
+          _authorize(functions, InstanceStore.updateDistributorType.selector, "updateDistributorType");
+          _authorize(functions, InstanceStore.updateDistributorTypeState.selector, "updateDistributorTypeState");
+          _authorize(functions, InstanceStore.createDistributor.selector, "createDistributor");
+          _authorize(functions, InstanceStore.updateDistributor.selector, "updateDistributor");
+          _authorize(functions, InstanceStore.updateDistributorState.selector, "updateDistributorState");
+          _authorize(functions, InstanceStore.createReferral.selector, "createReferral");
+          _authorize(functions, InstanceStore.updateReferral.selector, "updateReferral");
+          _authorize(functions, InstanceStore.updateReferralState.selector, "updateReferralState");
+
+          // authorize oracle service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(ORACLE()));
+          _authorize(functions, InstanceStore.createRequest.selector, "createRequest");
+          _authorize(functions, InstanceStore.updateRequest.selector, "updateRequest");
+          _authorize(functions, InstanceStore.updateRequestState.selector, "updateRequestState");
+
+          // authorize pool service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(POOL()));
+          _authorize(functions, InstanceStore.updatePool.selector, "updatePool");
+
+          // authorize bundle service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(BUNDLE()));
+          _authorize(functions, InstanceStore.createBundle.selector, "createBundle");
+          _authorize(functions, InstanceStore.updateBundle.selector, "updateBundle");
+          _authorize(functions, InstanceStore.updateBundleState.selector, "updateBundleState");
+          _authorize(functions, InstanceStore.increaseLocked.selector, "increaseLocked");
+          _authorize(functions, InstanceStore.decreaseLocked.selector, "decreaseLocked");
+
+          // authorize product service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(PRODUCT()));
+          _authorize(functions, InstanceStore.createRisk.selector, "createRisk");
+          _authorize(functions, InstanceStore.updateRisk.selector, "updateRisk");
+          _authorize(functions, InstanceStore.updateRiskState.selector, "updateRiskState");
+
+          // authorize application service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(APPLICATION()));
+          _authorize(functions, InstanceStore.createApplication.selector, "createApplication");
+          _authorize(functions, InstanceStore.updateApplication.selector, "updateApplication");
+          _authorize(functions, InstanceStore.updateApplicationState.selector, "updateApplicationState");
+
+          // authorize policy service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(POLICY()));
+          _authorize(functions, InstanceStore.updatePolicy.selector, "updatePolicy");
+          _authorize(functions, InstanceStore.updatePolicyState.selector, "updatePolicyState");
+
+          // authorize claim service role
+          functions = _authorizeForTarget(INSTANCE_STORE_TARGET_NAME, getServiceRole(CLAIM()));
+          _authorize(functions, InstanceStore.updatePolicyClaims.selector, "updatePolicyClaims");
+          _authorize(functions, InstanceStore.createClaim.selector, "createClaim");
+          _authorize(functions, InstanceStore.updateClaim.selector, "updateClaim");
+          _authorize(functions, InstanceStore.createPayout.selector, "createPayout");
+          _authorize(functions, InstanceStore.updatePayout.selector, "updatePayout");
+     }
+}
+

package/contracts/instance/InstanceAuthorizationsLib.sol

@@ -0,0 +1,422 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {RoleId, RoleIdLib, ADMIN_ROLE, DISTRIBUTION_OWNER_ROLE, POOL_OWNER_ROLE, PRODUCT_OWNER_ROLE, ORACLE_OWNER_ROLE} from "../type/RoleId.sol";
+import {APPLICATION, BUNDLE, CLAIM, COMPONENT, DISTRIBUTION, INSTANCE, ORACLE, POLICY, POOL, PRODUCT, REGISTRY} from "../type/ObjectType.sol";
+import {VersionPart} from "../type/Version.sol";
+
+import {IRegistry} from "../registry/IRegistry.sol";
+
+import {Instance} from "./Instance.sol";
+import {InstanceAdmin} from "./InstanceAdmin.sol";
+import {InstanceReader} from "./InstanceReader.sol";
+import {BundleManager} from "./BundleManager.sol";
+import {AccessManagerExtendedInitializeable} from "../shared/AccessManagerExtendedInitializeable.sol";
+import {InstanceStore} from "./InstanceStore.sol";
+
+function INSTANCE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2600); }
+
+/// @dev required role to own an instance.
+/// Role is granted by instance service when cloning a new instance.
+/// allows instance specific target, role and access management 
+function INSTANCE_OWNER_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(10); }
+
+
+function REGISTRY_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(1800); }
+
+/// @dev instance specific role for instance service
+function INSTANCE_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2000); }
+
+/// @dev role for registering gif components
+function COMPONENT_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2001); }
+
+/// @dev instance specific role for distribution service
+function DISTRIBUTION_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2100); }
+
+/// @dev instance specific role for oracle service
+function ORACLE_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2150); }
+
+/// @dev instance specific role for pool service
+function POOL_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2200); }
+
+/// @dev instance specific role for product service
+function PRODUCT_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2300); }
+
+/// @dev instance specific role for application service
+function APPLICATION_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2400); }
+
+/// @dev instance specific role for policy service
+function POLICY_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2410); }
+
+/// @dev instance specific role for claim service
+function CLAIM_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2420); }
+
+/// @dev instance specific role for bundle service
+function BUNDLE_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2500); }
+
+/// @dev instance specific role for pricing service
+function PRICING_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2800); }
+
+/// @dev instance specific role for staking service
+function STAKING_SERVICE_ROLE() pure returns (RoleId) { return RoleIdLib.toRoleId(2900); }
+
+library InstanceAuthorizationsLib
+{
+    function grantInitialAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        Instance instance,
+        BundleManager bundleManager,
+        InstanceStore instanceStore,
+        address instanceOwner,
+        IRegistry registry,
+        VersionPart majorVersion)
+            external
+    {
+        _createRoles(instanceAdmin);
+        _createTargets(instanceAdmin, instance, bundleManager, instanceStore);
+        _grantComponentServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
+        _grantOracleServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
+        _grantDistributionServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
+        _grantPoolServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
+        _grantProductServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
+        _grantApplicationServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
+        _grantPolicyServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
+        _grantClaimServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
+        _grantBundleServiceAuthorizations(accessManager, instanceAdmin, instanceStore, bundleManager, registry, majorVersion);
+        _grantInstanceServiceAuthorizations(accessManager, instanceAdmin, instance, registry, majorVersion);
+        _grantInstanceAuthorizations(accessManager, instanceAdmin, instance, registry, majorVersion);
+        _grantInstanceOwnerAuthorizations(instanceAdmin, instance, registry, majorVersion);
+    }
+
+    function _createRoles(InstanceAdmin instanceAdmin) private {
+        // default roles controlled by ADMIN_ROLE -> core roles
+        // all set/granted only once during cloning (the only exception is INSTANCE_OWNER_ROLE, hooked to instance nft)
+        instanceAdmin.createCoreRole(INSTANCE_SERVICE_ROLE(), "InstanceServiceRole");
+        instanceAdmin.createCoreRole(COMPONENT_SERVICE_ROLE(), "ComponentServiceRole");
+        instanceAdmin.createCoreRole(DISTRIBUTION_SERVICE_ROLE(), "DistributionServiceRole");
+        instanceAdmin.createCoreRole(ORACLE_SERVICE_ROLE(), "OracleServiceRole");
+        instanceAdmin.createCoreRole(POOL_SERVICE_ROLE(), "PoolServiceRole");
+        instanceAdmin.createCoreRole(APPLICATION_SERVICE_ROLE(), "ApplicationServiceRole");
+        instanceAdmin.createCoreRole(PRODUCT_SERVICE_ROLE(), "ProductServiceRole");
+        instanceAdmin.createCoreRole(CLAIM_SERVICE_ROLE(), "ClaimServiceRole");
+        instanceAdmin.createCoreRole(POLICY_SERVICE_ROLE(), "PolicyServiceRole");
+        instanceAdmin.createCoreRole(BUNDLE_SERVICE_ROLE(), "BundleServiceRole");
+
+        // default roles controlled by INSTANCE_OWNER_ROLE -> gif roles
+        instanceAdmin.createGifRole(DISTRIBUTION_OWNER_ROLE(), "DistributionOwnerRole", INSTANCE_OWNER_ROLE());
+        instanceAdmin.createGifRole(ORACLE_OWNER_ROLE(), "OracleOwnerRole", INSTANCE_OWNER_ROLE());
+        instanceAdmin.createGifRole(POOL_OWNER_ROLE(), "PoolOwnerRole", INSTANCE_OWNER_ROLE());
+        instanceAdmin.createGifRole(PRODUCT_OWNER_ROLE(), "ProductOwnerRole", INSTANCE_OWNER_ROLE());
+    }
+
+    function _createTargets(
+        InstanceAdmin instanceAdmin,
+        Instance instance,
+        BundleManager bundleManager,
+        InstanceStore instanceStore)
+        private
+    {
+        instanceAdmin.createCoreTarget(address(instance), "Instance");
+        //instanceAdmin.createCoreTarget(address(instanceAdmin), "InstanceAdmin");
+        instanceAdmin.createCoreTarget(address(bundleManager), "BundleManager");
+        instanceAdmin.createCoreTarget(address(instanceStore), "InstanceStore");
+    }
+
+    function _grantComponentServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        InstanceStore instanceStore,
+        IRegistry registry,
+        VersionPart majorVersion)
+        private
+    {
+        // configure authorization for component service on instance store
+        address componentServiceAddress = registry.getServiceAddress(COMPONENT(), majorVersion);
+        accessManager.grantRole(COMPONENT_SERVICE_ROLE().toInt(), componentServiceAddress, 0);
+
+        bytes4[] memory serviceSelectors = new bytes4[](8);
+        serviceSelectors[0] = instanceStore.createComponent.selector;
+        serviceSelectors[1] = instanceStore.updateComponent.selector;
+        serviceSelectors[2] = instanceStore.createPool.selector;
+        serviceSelectors[3] = instanceStore.createProduct.selector;
+        serviceSelectors[5] = instanceStore.updateProduct.selector;
+        serviceSelectors[6] = instanceStore.increaseBalance.selector;
+        serviceSelectors[7] = instanceStore.increaseFees.selector;
+
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            serviceSelectors,
+            COMPONENT_SERVICE_ROLE());
+    }
+
+    function _grantOracleServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        InstanceStore instanceStore,
+        IRegistry registry,
+        VersionPart majorVersion
+    )
+        private
+    {
+        // configure authorization for distribution service on instance
+        address oracleServiceAddress = registry.getServiceAddress(ORACLE(), majorVersion);
+        accessManager.grantRole(ORACLE_SERVICE_ROLE().toInt(), oracleServiceAddress, 0);
+
+        bytes4[] memory instanceOracleServiceSelectors = new bytes4[](3);
+        instanceOracleServiceSelectors[0] = instanceStore.createRequest.selector;
+        instanceOracleServiceSelectors[1] = instanceStore.updateRequest.selector;
+        instanceOracleServiceSelectors[2] = instanceStore.updateRequestState.selector;
+
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            instanceOracleServiceSelectors,
+            ORACLE_SERVICE_ROLE());
+    }
+
+    function _grantDistributionServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        InstanceStore instanceStore,
+        IRegistry registry,
+        VersionPart majorVersion
+    )
+        private
+    {
+        // configure authorization for distribution service on instance
+        address distributionServiceAddress = registry.getServiceAddress(DISTRIBUTION(), majorVersion);
+        accessManager.grantRole(DISTRIBUTION_SERVICE_ROLE().toInt(), distributionServiceAddress, 0);
+        bytes4[] memory instanceDistributionServiceSelectors = new bytes4[](9);
+        //instanceDistributionServiceSelectors[0] = instanceStore.createDistributionSetup.selector;
+        //instanceDistributionServiceSelectors[1] = instanceStore.updateDistributionSetup.selector;
+        instanceDistributionServiceSelectors[0] = instanceStore.createDistributorType.selector;
+        instanceDistributionServiceSelectors[1] = instanceStore.updateDistributorType.selector;
+        instanceDistributionServiceSelectors[2] = instanceStore.updateDistributorTypeState.selector;
+        instanceDistributionServiceSelectors[3] = instanceStore.createDistributor.selector;
+        instanceDistributionServiceSelectors[4] = instanceStore.updateDistributor.selector;
+        instanceDistributionServiceSelectors[5] = instanceStore.updateDistributorState.selector;
+        instanceDistributionServiceSelectors[6] = instanceStore.createReferral.selector;
+        instanceDistributionServiceSelectors[7] = instanceStore.updateReferral.selector;
+        instanceDistributionServiceSelectors[8] = instanceStore.updateReferralState.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            instanceDistributionServiceSelectors,
+            DISTRIBUTION_SERVICE_ROLE());
+    }
+
+    function _grantPoolServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        InstanceStore instanceStore,
+        IRegistry registry,
+        VersionPart majorVersion)
+        private
+    {
+        // configure authorization for pool service on instance
+        address poolServiceAddress = registry.getServiceAddress(POOL(), majorVersion);
+        accessManager.grantRole(POOL_SERVICE_ROLE().toInt(), address(poolServiceAddress), 0);
+        bytes4[] memory instancePoolServiceSelectors = new bytes4[](1); // TODO works with (4)
+        instancePoolServiceSelectors[0] = instanceStore.updatePool.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            instancePoolServiceSelectors,
+            POOL_SERVICE_ROLE());
+    }
+
+    function _grantProductServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        InstanceStore instanceStore,
+        IRegistry registry,
+        VersionPart majorVersion)
+        private
+    {
+        // configure authorization for product service on instance
+        address productServiceAddress = registry.getServiceAddress(PRODUCT(), majorVersion);
+        accessManager.grantRole(PRODUCT_SERVICE_ROLE().toInt(), productServiceAddress, 0);
+        bytes4[] memory instanceProductServiceSelectors = new bytes4[](3);
+        instanceProductServiceSelectors[0] = instanceStore.createRisk.selector;
+        instanceProductServiceSelectors[1] = instanceStore.updateRisk.selector;
+        instanceProductServiceSelectors[2] = instanceStore.updateRiskState.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            instanceProductServiceSelectors,
+            PRODUCT_SERVICE_ROLE());
+    }
+
+    function _grantApplicationServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        InstanceStore instanceStore,
+        IRegistry registry,
+        VersionPart majorVersion)
+        private
+    {
+        // configure authorization for application services on instance
+        address applicationServiceAddress = registry.getServiceAddress(APPLICATION(), majorVersion);
+        accessManager.grantRole(APPLICATION_SERVICE_ROLE().toInt(), applicationServiceAddress, 0);
+        bytes4[] memory instanceApplicationServiceSelectors = new bytes4[](3);
+        instanceApplicationServiceSelectors[0] = instanceStore.createApplication.selector;
+        instanceApplicationServiceSelectors[1] = instanceStore.updateApplication.selector;
+        instanceApplicationServiceSelectors[2] = instanceStore.updateApplicationState.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            instanceApplicationServiceSelectors,
+            APPLICATION_SERVICE_ROLE());
+    }
+
+    function _grantPolicyServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        InstanceStore instanceStore,
+        IRegistry registry,
+        VersionPart majorVersion)
+        private
+    {
+        // configure authorization for policy services on instance
+        address policyServiceAddress = registry.getServiceAddress(POLICY(), majorVersion);
+        accessManager.grantRole(POLICY_SERVICE_ROLE().toInt(), policyServiceAddress, 0);
+        bytes4[] memory instancePolicyServiceSelectors = new bytes4[](2);
+        instancePolicyServiceSelectors[0] = instanceStore.updatePolicy.selector;
+        instancePolicyServiceSelectors[1] = instanceStore.updatePolicyState.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            instancePolicyServiceSelectors,
+            POLICY_SERVICE_ROLE());
+    }
+
+    function _grantClaimServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        InstanceStore instanceStore,
+        IRegistry registry,
+        VersionPart majorVersion)
+        private
+    {
+        // configure authorization for claim/payout services on instance
+        address claimServiceAddress = registry.getServiceAddress(CLAIM(), majorVersion);
+        accessManager.grantRole(CLAIM_SERVICE_ROLE().toInt(), claimServiceAddress, 0);
+
+        bytes4[] memory instancePolicyServiceSelectors = new bytes4[](1);
+        instancePolicyServiceSelectors[0] = instanceStore.updatePolicyClaims.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            instancePolicyServiceSelectors, 
+            CLAIM_SERVICE_ROLE());
+
+        bytes4[] memory instanceClaimServiceSelectors = new bytes4[](4);
+        instanceClaimServiceSelectors[0] = instanceStore.createClaim.selector;
+        instanceClaimServiceSelectors[1] = instanceStore.updateClaim.selector;
+        instanceClaimServiceSelectors[2] = instanceStore.createPayout.selector;
+        instanceClaimServiceSelectors[3] = instanceStore.updatePayout.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            instanceClaimServiceSelectors, 
+            CLAIM_SERVICE_ROLE());
+    }
+
+    function _grantBundleServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        InstanceStore instanceStore,
+        BundleManager bundleManager,
+        IRegistry registry,
+        VersionPart majorVersion)
+        private
+    {
+        // configure authorization for bundle service on instance
+        address bundleServiceAddress = registry.getServiceAddress(BUNDLE(), majorVersion);
+        accessManager.grantRole(BUNDLE_SERVICE_ROLE().toInt(), bundleServiceAddress, 0);
+        bytes4[] memory instanceBundleServiceSelectors = new bytes4[](5);
+        instanceBundleServiceSelectors[0] = instanceStore.createBundle.selector;
+        instanceBundleServiceSelectors[1] = instanceStore.updateBundle.selector;
+        instanceBundleServiceSelectors[2] = instanceStore.updateBundleState.selector;
+        instanceBundleServiceSelectors[3] = instanceStore.increaseLocked.selector;
+        instanceBundleServiceSelectors[4] = instanceStore.decreaseLocked.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            instanceBundleServiceSelectors,
+            BUNDLE_SERVICE_ROLE());
+
+        // configure authorization for bundle service on bundle manager
+        bytes4[] memory bundleManagerBundleServiceSelectors = new bytes4[](5);
+        bundleManagerBundleServiceSelectors[0] = bundleManager.linkPolicy.selector;
+        bundleManagerBundleServiceSelectors[1] = bundleManager.unlinkPolicy.selector;
+        bundleManagerBundleServiceSelectors[2] = bundleManager.add.selector;
+        bundleManagerBundleServiceSelectors[3] = bundleManager.lock.selector;
+        bundleManagerBundleServiceSelectors[4] = bundleManager.unlock.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "BundleManager",
+            bundleManagerBundleServiceSelectors,
+            BUNDLE_SERVICE_ROLE());
+    }
+
+    function _grantInstanceServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        Instance instance,
+        IRegistry registry,
+        VersionPart majorVersion)
+        private
+    {
+        // configure authorization for instance service on instance
+        address instanceServiceAddress = registry.getServiceAddress(INSTANCE(), majorVersion);
+        accessManager.grantRole(INSTANCE_SERVICE_ROLE().toInt(), instanceServiceAddress, 0);
+        bytes4[] memory instanceInstanceServiceSelectors = new bytes4[](1);
+        instanceInstanceServiceSelectors[0] = instance.setInstanceReader.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "Instance",
+            instanceInstanceServiceSelectors,
+            INSTANCE_SERVICE_ROLE());
+
+        // configure authorizations for instance service on instance access manager
+        bytes4[] memory instanceAdminInstanceServiceSelectors = new bytes4[](3);
+        instanceAdminInstanceServiceSelectors[0] = instanceAdmin.createGifTarget.selector;
+        instanceAdminInstanceServiceSelectors[1] = instanceAdmin.setTargetLockedByService.selector;
+        instanceAdminInstanceServiceSelectors[2] = instanceAdmin.setTargetFunctionRoleByService.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceAdmin",
+            instanceAdminInstanceServiceSelectors,
+            INSTANCE_SERVICE_ROLE());
+    }
+
+    function _grantInstanceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        Instance instance,
+        IRegistry registry,
+        VersionPart majorVersion)
+        private
+    {
+        // configure authorizations for instance on instance admin
+        bytes4[] memory instanceAdminInstanceSelectors = new bytes4[](4);
+        instanceAdminInstanceSelectors[0] = instanceAdmin.createRole.selector;
+        instanceAdminInstanceSelectors[1] = instanceAdmin.createTarget.selector;
+        instanceAdminInstanceSelectors[2] = instanceAdmin.setTargetFunctionRoleByInstance.selector;
+        instanceAdminInstanceSelectors[3] = instanceAdmin.setTargetLockedByInstance.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceAdmin",
+            instanceAdminInstanceSelectors,
+            INSTANCE_ROLE());
+    }
+
+    function _grantInstanceOwnerAuthorizations(
+        InstanceAdmin instanceAdmin,
+        Instance instance,
+        IRegistry registry,
+        VersionPart majorVersion) 
+        private 
+    {
+        // configure authorization for instance owner on instance access manager
+        // instance owner role is granted/revoked ONLY by INSTANCE_ROLE
+        bytes4[] memory instanceInstanceOwnerSelectors = new bytes4[](4);
+        instanceInstanceOwnerSelectors[0] = instance.createRole.selector;
+        instanceInstanceOwnerSelectors[1] = instance.createTarget.selector;
+        instanceInstanceOwnerSelectors[2] = instance.setTargetFunctionRole.selector;
+        instanceInstanceOwnerSelectors[3] = instance.setTargetLocked.selector;
+        instanceAdmin.setTargetFunctionRoleByService(
+            "Instance",
+            instanceInstanceOwnerSelectors,
+            INSTANCE_OWNER_ROLE());
+    }
+}