@etherisc/gif-next 0.0.2-f1e0c66-773 → 0.0.2-f1e6957-384

package/contracts/authorization/ServiceAuthorization.sol

@@ -2,89 +2,299 @@
 pragma solidity ^0.8.20;
 
 import {IAccess} from "../authorization/IAccess.sol";
-import {ObjectType} from "../type/ObjectType.sol";
 import {IServiceAuthorization} from "./IServiceAuthorization.sol";
+
+import {AccessAdminLib} from "./AccessAdminLib.sol";
+import {BlocknumberLib} from "../type/Blocknumber.sol";
+import {InitializableERC165} from "../shared/InitializableERC165.sol";
+import {ObjectType, ObjectTypeLib, ALL} from "../type/ObjectType.sol";
+import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
 import {SelectorLib} from "../type/Selector.sol";
-import {StrLib} from "../type/String.sol";
+import {Str, StrLib} from "../type/String.sol";
 import {TimestampLib} from "../type/Timestamp.sol";
 import {VersionPart, VersionPartLib} from "../type/Version.sol";
 
-/// @dev Base contract for release specific service authorization contracts.
-contract ServiceAuthorization
-     is IServiceAuthorization
+
+/// @dev Base contract for release specific service authorization contracts and for Authorization contracts.
+contract ServiceAuthorization is 
+     InitializableERC165,
+     IServiceAuthorization
 {
-     uint256 public constant GIF_VERSION_3 = 3;
 
-     string private _commitHash;
+     string public constant COMMIT_HASH = "1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a";
+
+     uint256 public constant COMMIT_HASH_LENGTH = 40;
+     uint256 public constant GIF_INITIAL_VERSION = 3;
+
+     string public constant SERVICE_NAME_SUFFIX = "Service";
+     string public constant ROLE_NAME_SUFFIX = "_Role";
+
+     ObjectType public immutable DOMAIN;
+     uint256 internal immutable _release;
+     string internal _commitHash;
 
+     string internal _mainTargetName;
+     Str internal _mainTarget;
+
+     // services
      ObjectType[] internal _serviceDomains;
      mapping(ObjectType domain => address service) internal _serviceAddress;
-     mapping(ObjectType domain => ObjectType[] authorizedDomains) internal _authorizedDomains;
-     mapping(ObjectType domain => mapping(ObjectType authorizedDomain => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
 
-     constructor(string memory commitHash) {
+     // roles
+     RoleId[] internal _roles;
+     mapping(RoleId role => RoleInfo info) internal _roleInfo;
+
+     // targets
+     Str[] internal _targets;
+     mapping(Str target => bool exists) internal _targetExists;
+     mapping(Str target => RoleId roleId) internal _targetRole;
+     mapping(Str target => RoleId[] authorizedRoles) internal _authorizedRoles;
+     mapping(Str target => mapping(RoleId authorizedRole => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
+
+
+     constructor(
+          string memory mainTargetName, 
+          ObjectType domain,
+          uint8 release,
+          string memory commitHash
+     )
+     {
+          // checks
+          if (bytes(mainTargetName).length == 0) {
+               revert ErrorAuthorizationMainTargetNameEmpty();
+          }
+
+          if (domain == ObjectTypeLib.zero()) {
+               revert ErrorAuthorizationTargetDomainZero();
+          }
+
+          if (release < VersionPartLib.releaseMin().toInt() || release >= VersionPartLib.releaseMax().toInt()) {
+               revert ErrorAuthorizationReleaseInvalid(release);
+          }
+
+          if (bytes(commitHash).length != COMMIT_HASH_LENGTH) {
+               revert ErrorAuthorizationCommitHashInvalid(commitHash);
+          }
+
+          // effects
+          _initializeERC165();
+          _registerInterfaceNotInitializing(type(IServiceAuthorization).interfaceId);
+
+          _mainTargetName = mainTargetName;
+          _mainTarget = StrLib.toStr(mainTargetName);
+
+          DOMAIN = domain;
+          _release = release;
           _commitHash = commitHash;
+
+          // setup of roles defined in OpenZeppelin AccessManager
+          _addRole(ADMIN_ROLE(), AccessAdminLib.adminRoleInfo());
+          _addRole(PUBLIC_ROLE(), AccessAdminLib.publicRoleInfo());
+
+          // defines service domains relevant for the authorization
           _setupDomains();
           _setupDomainAuthorizations();
      }
 
+     /// @inheritdoc IServiceAuthorization
+     function getDomain() public view returns(ObjectType targetDomain) {
+          return DOMAIN;
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getRelease() public view returns(VersionPart release) {
+          return VersionPartLib.toVersionPart(_release);
+     }
+
+     /// @inheritdoc IServiceAuthorization
      function getCommitHash() external view returns(string memory commitHash) {
           return _commitHash;
      }
 
-     function getRelease() external view returns(VersionPart release) {
-          return VersionPartLib.toVersionPart(GIF_VERSION_3);
+     /// @inheritdoc IServiceAuthorization
+     function getMainTargetName() public view returns (string memory name) {
+          return _mainTargetName;
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getMainTarget() external view returns(Str target) {
+          return _mainTarget;
      }
 
+     /// @inheritdoc IServiceAuthorization
      function getServiceDomains() external view returns(ObjectType[] memory serviceDomains) {
           return _serviceDomains;
      }
 
-     function getServiceDomain(uint idx) external view returns(ObjectType serviceDomain) {
+     /// @inheritdoc IServiceAuthorization
+     function getServiceDomain(uint256 idx) external view returns(ObjectType serviceDomain) {
           return _serviceDomains[idx];
      }
 
+     /// @inheritdoc IServiceAuthorization
+     function getServiceTarget(ObjectType serviceDomain) public view returns(Str target) {
+          string memory serviceTargetName = ObjectTypeLib.toVersionedName(
+               ObjectTypeLib.toName(serviceDomain), 
+               "Service", 
+               getRelease());
+
+          return StrLib.toStr(serviceTargetName);
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getServiceRole(ObjectType serviceDomain) public view returns(RoleId serviceRoleId) {
+          // special case domain ALL
+          if (serviceDomain == ALL()) {
+               return PUBLIC_ROLE();
+          }
+
+          Str target = getServiceTarget(serviceDomain);
+          return getTargetRole(target);
+     }
+
+     /// @inheritdoc IServiceAuthorization
      function getServiceAddress(ObjectType serviceDomain) external view returns(address service) {
           return _serviceAddress[serviceDomain];
      }
 
-     function getAuthorizedDomains(ObjectType serviceDomain) external view returns(ObjectType[] memory authorizatedDomains) {
-          return _authorizedDomains[serviceDomain];
+     /// @inheritdoc IServiceAuthorization
+     function getTargetRole(Str target) public view returns(RoleId roleId) {
+          return _targetRole[target];
      }
 
-     function getAuthorizedFunctions(ObjectType serviceDomain, ObjectType authorizedDomain) external view returns(IAccess.FunctionInfo[] memory authorizatedFunctions) {
-          return _authorizedFunctions[serviceDomain][authorizedDomain];
+     /// @inheritdoc IServiceAuthorization
+     function roleExists(RoleId roleId) public view returns(bool exists) {
+          return _roleInfo[roleId].targetType != TargetType.Undefined;
      }
 
-     /// @dev Overwrite this function for a specific realease.
+     /// @inheritdoc IServiceAuthorization
+     function getRoles() external view returns(RoleId[] memory roles) {
+          return _roles;
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory info) {
+          return _roleInfo[roleId];
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getRoleName(RoleId roleId) external view returns (string memory roleName) {
+          return _roleInfo[roleId].name.toString();
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getAuthorizedRoles(Str target) external view returns(RoleId[] memory roleIds) {
+          return _authorizedRoles[target];
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getAuthorizedFunctions(Str target, RoleId roleId) external view returns(FunctionInfo[] memory authorizatedFunctions) {
+          return _authorizedFunctions[target][roleId];
+     }
+
+     /// @dev Defines service domains relevant for the authorization.
+     /// When used for ReleaseAdmin the list defines the services to be registered for the release.
+     /// IMPORTANT: Both the list of the service domains as well as the ordering of the domains is important.
+     /// Trying to register services not in this list or register services in a different order will result in an error.
+     // solhint-disable-next-line no-empty-blocks
      function _setupDomains() internal virtual {}
 
      /// @dev Overwrite this function for a specific realease.
+     // solhint-disable-next-line no-empty-blocks
      function _setupDomainAuthorizations() internal virtual {}
 
      /// @dev Use this method to to add an authorized domain.
      /// The services will need to be registered in the order they are added using this function.
-     function _authorizeDomain(ObjectType serviceDomain, address serviceAddress) internal {
+     function _authorizeServiceDomain(ObjectType serviceDomain, address serviceAddress) internal {
           _serviceDomains.push(serviceDomain);
           _serviceAddress[serviceDomain] = serviceAddress;
+
+          string memory serviceName = ObjectTypeLib.toVersionedName(
+               ObjectTypeLib.toName(serviceDomain), 
+               SERVICE_NAME_SUFFIX, 
+               getRelease());
+
+          _addTargetWithRole(
+               serviceName, 
+               RoleIdLib.toServiceRoleId(serviceDomain, getRelease()), 
+               string(abi.encodePacked(serviceName, ROLE_NAME_SUFFIX)));
      }
 
+
+     /// @dev Use this method to to add an authorized target together with its target role.
+     function _addTargetWithRole(
+          string memory targetName, 
+          RoleId roleId, 
+          string memory roleName
+     )
+          internal
+     {
+          // add target
+          Str target = StrLib.toStr(targetName);
+          _targets.push(target);
+
+          _targetExists[target] = true;
+
+          // link role to target if defined
+          if (roleId != RoleIdLib.zero()) {
+               // add role if new
+               if (!roleExists(roleId)) {
+                    _addRole(
+                         roleId, 
+                         AccessAdminLib.serviceRoleInfo(roleName));
+               }
+
+               // link target to role
+               _targetRole[target] = roleId;
+          }
+     }
+
+
+     /// @dev Use this method to to add an authorized role.
+     function _addRole(RoleId roleId, RoleInfo memory info) internal {
+          _roles.push(roleId);
+          _roleInfo[roleId] = info;
+     }
+
+
      /// @dev Use this method to authorize the specified domain to access the service domain.
-     function _authorizeForService(ObjectType serviceDomain, ObjectType authorizedDomain)
+     function _authorizeForService(
+          ObjectType serviceDomain, 
+          ObjectType authorizedDomain
+     )
+          internal
+          returns (IAccess.FunctionInfo[] storage authorizatedFunctions)
+     {
+          Str serviceTarget = getServiceTarget(serviceDomain);
+          RoleId authorizedRoleId = getServiceRole(authorizedDomain);
+
+          return _authorizeForTarget(serviceTarget.toString(), authorizedRoleId);
+     }
+
+
+     /// @dev Use this method to authorize the specified role to access the target.
+     function _authorizeForTarget(string memory target, RoleId authorizedRoleId)
           internal
           returns (IAccess.FunctionInfo[] storage authorizatedFunctions)
      {
-          _authorizedDomains[serviceDomain].push(authorizedDomain);
-          return _authorizedFunctions[serviceDomain][authorizedDomain];
+          Str targetStr = StrLib.toStr(target);
+
+          // add authorized role if not already added
+          if (_authorizedFunctions[targetStr][authorizedRoleId].length == 0) {
+               _authorizedRoles[targetStr].push(authorizedRoleId);
+          }
+
+          return _authorizedFunctions[targetStr][authorizedRoleId];
      }
 
+
      /// @dev Use this method to authorize a specific function authorization
      function _authorize(IAccess.FunctionInfo[] storage functions, bytes4 selector, string memory name) internal {
           functions.push(
                IAccess.FunctionInfo({
                     selector: SelectorLib.toSelector(selector),
                     name: StrLib.toStr(name),
-                    createdAt: TimestampLib.blockTimestamp()}));
+                    createdAt: TimestampLib.current(),
+                    lastUpdateIn: BlocknumberLib.current()}));
      }
-}
-
+}

package/contracts/distribution/BasicDistribution.sol

@@ -1,14 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {Distribution} from "./Distribution.sol";
 import {IAuthorization} from "../authorization/IAuthorization.sol";
+
+import {Distribution} from "./Distribution.sol";
+import {DistributorType} from "../type/DistributorType.sol";
+import {DISTRIBUTOR} from "../type/ObjectType.sol";
+import {Fee} from "../type/Fee.sol";
 import {NftId} from "../type/NftId.sol";
 import {ReferralId} from "../type/Referral.sol";
-import {Fee} from "../type/Fee.sol";
-import {UFixed} from "../type/UFixed.sol";
-import {DistributorType} from "../type/DistributorType.sol";
+import {Seconds} from "../type/Seconds.sol";
 import {Timestamp} from "../type/Timestamp.sol";
+import {UFixed} from "../type/UFixed.sol";
 
 
 contract BasicDistribution is
@@ -36,15 +39,15 @@ contract BasicDistribution is
         UFixed maxDiscountPercentage,
         UFixed commissionPercentage,
         uint32 maxReferralCount,
-        uint32 maxReferralLifetime,
+        Seconds maxReferralLifetime,
         bool allowSelfReferrals,
         bool allowRenewals,
         bytes memory data
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
         returns (DistributorType distributorType)
     {
         return _createDistributorType(
@@ -66,24 +69,25 @@ contract BasicDistribution is
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
         returns(NftId distributorNftId)
     {
         return _createDistributor(distributor, distributorType, data);
     }
 
-    function updateDistributorType(
+    function changeDistributorType(
         NftId distributorNftId,
         DistributorType distributorType,
         bytes memory data
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
+        onlyNftOfType(distributorNftId, DISTRIBUTOR())
     {
-        _updateDistributorType(distributorNftId, distributorType, data);
+        _changeDistributorType(distributorNftId, distributorType, data);
     }
 
     /**
@@ -91,6 +95,7 @@ contract BasicDistribution is
      * referral codes need to be unique
      */
     function createReferral(
+        NftId distributorNftId,
         string memory code,
         UFixed discountPercentage,
         uint32 maxReferrals,
@@ -99,11 +104,11 @@ contract BasicDistribution is
     )
         external
         virtual
-        onlyDistributor()
         restricted()
+        onlyNftOwner(distributorNftId)
         returns (ReferralId referralId)
     {
-        NftId distributorNftId = getDistributorNftId(msg.sender);
+        _checkNftType(distributorNftId, DISTRIBUTOR());
         return _createReferral(
             distributorNftId,
             code,
@@ -118,21 +123,18 @@ contract BasicDistribution is
         NftId instanceNftId,
         IAuthorization authorization, 
         address initialOwner,
-        string memory name,
-        address token
+        string memory name
     )
         internal
         virtual
         onlyInitializing()
     {
-        _initializeDistribution(
+        __Distribution_init(
             registry, 
             instanceNftId, 
             authorization,
+            false,
             initialOwner, 
-            name, 
-            token, 
-            "", // registry data
-            ""); // component specifc data
+            name); 
     }
 }

package/contracts/distribution/BasicDistributionAuthorization.sol

@@ -1,30 +1,50 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {IAccess} from "../authorization/IAccess.sol";
+import {IInstanceLinkedComponent} from "../shared/IInstanceLinkedComponent.sol";
+
 import {Authorization} from "../authorization/Authorization.sol";
 import {BasicDistribution} from "./BasicDistribution.sol"; 
 import {Distribution} from "./Distribution.sol";
-import {DISTRIBUTION} from "../type/ObjectType.sol";
-import {IAccess} from "../authorization/IAccess.sol";
-import {IInstanceLinkedComponent} from "../shared/IInstanceLinkedComponent.sol";
-import {PUBLIC_ROLE} from "../../contracts/type/RoleId.sol";
+import {COMPONENT, DISTRIBUTION} from "../type/ObjectType.sol";
+import {PUBLIC_ROLE} from "../type/RoleId.sol";
+import {TokenHandler} from "../shared/TokenHandler.sol";
 
 
 contract BasicDistributionAuthorization
      is Authorization
 {
 
-     constructor(string memory distributionlName)
-          Authorization(distributionlName)
+     constructor(string memory distributionName)
+          Authorization(
+               distributionName, 
+               DISTRIBUTION(), 
+               3,
+               COMMIT_HASH,
+               TargetType.Component, 
+               true)
      {}
 
-     function _setupTargets()
+     function _setupServiceTargets()
           internal
           virtual override
      {
-          _addComponentTargetWithRole(DISTRIBUTION()); // basic target
+          _authorizeServiceDomain(COMPONENT(), address(11));
+          _authorizeServiceDomain(DISTRIBUTION(), address(11));
      }
 
+     function _setupTokenHandlerAuthorizations() internal virtual override {
+          IAccess.FunctionInfo[] storage functions;
+          functions = _authorizeForTarget(getTokenHandlerName(), getServiceRole(COMPONENT()));
+          _authorize(functions, TokenHandler.approve.selector, "approve");
+          _authorize(functions, TokenHandler.setWallet.selector, "setWallet");
+          _authorize(functions, TokenHandler.pushFeeToken.selector, "pushFeeToken");
+
+          // authorize token handler functions for pool service role
+          functions = _authorizeForTarget(getTokenHandlerName(), getServiceRole(DISTRIBUTION()));
+          _authorize(functions, TokenHandler.pushToken.selector, "pushToken");
+     }
 
      function _setupTargetAuthorizations()
           internal
@@ -33,11 +53,11 @@ contract BasicDistributionAuthorization
           IAccess.FunctionInfo[] storage functions;
 
           // authorize public role (open access to any account, only allows to lock target)
-          functions = _authorizeForTarget(getTargetName(), PUBLIC_ROLE());
+          functions = _authorizeForTarget(getMainTargetName(), PUBLIC_ROLE());
           _authorize(functions, BasicDistribution.setFees.selector, "setFees");
           _authorize(functions, BasicDistribution.createDistributorType.selector, "createDistributorType");
           _authorize(functions, BasicDistribution.createDistributor.selector, "createDistributor");
-          _authorize(functions, BasicDistribution.updateDistributorType.selector, "updateDistributorType");
+          _authorize(functions, BasicDistribution.changeDistributorType.selector, "changeDistributorType");
           _authorize(functions, BasicDistribution.createReferral.selector, "createReferral");
           
           _authorize(functions, IInstanceLinkedComponent.withdrawFees.selector, "withdrawFees");