@etherisc/gif-next 0.0.2-fd2113c-488 → 0.0.2-fd2ea71-734

package/contracts/registry/Registry.sol

@@ -8,12 +8,12 @@ import {InitializableCustom} from "../shared/InitializableCustom.sol";
 
 import {NftId, NftIdLib} from "../type/NftId.sol";
 import {VersionPart} from "../type/Version.sol";
-import {ObjectType, PROTOCOL, REGISTRY, TOKEN, SERVICE, INSTANCE, STAKE, STAKING, PRODUCT, DISTRIBUTION, DISTRIBUTOR, ORACLE, POOL, POLICY, BUNDLE} from "../type/ObjectType.sol";
+import {ObjectType, PROTOCOL, REGISTRY, SERVICE, INSTANCE, STAKE, STAKING, PRODUCT, DISTRIBUTION, DISTRIBUTOR, ORACLE, POOL, POLICY, BUNDLE} from "../type/ObjectType.sol";
 
 import {ChainNft} from "./ChainNft.sol";
 import {IRegistry} from "./IRegistry.sol";
 import {IRegisterable} from "../shared/IRegisterable.sol";
-import {ReleaseManager} from "./ReleaseManager.sol";
+import {ReleaseRegistry} from "./ReleaseRegistry.sol";
 import {TokenRegistry} from "./TokenRegistry.sol";
 import {RegistryAdmin} from "./RegistryAdmin.sol";
 
@@ -27,6 +27,8 @@ import {RegistryAdmin} from "./RegistryAdmin.sol";
 // 3) IRegisterable address by regular service (INSTANCE, PRODUCT, POOL, DISTRIBUTION, ORACLE)
 // 4) state object by regular service (POLICY, BUNDLE, STAKE)
 
+/// @title Chain Registry contract implementing IRegistry.
+/// @notice See IRegistry for method details.
 contract Registry is
     InitializableCustom,
     IRegistry
@@ -58,30 +60,31 @@ contract Registry is
 
     address public _tokenRegistryAddress;
     address public _stakingAddress;
-    ReleaseManager public _releaseManager;
+    ReleaseRegistry public _releaseRegistry;
 
     // TODO 
-    // 1). Registry and ReleaseManager must be treated as whole single entity. 
+    // 1). Registry and ReleaseRegistry must be treated as whole single entity. 
     //     But current limitations of EVM does not allow it -> require it to be splitted
-    // 2). Keep onlyReleaseManager modifier
-    // 3). Delete onlyRegistryService in favor of restricted, introduce aditional "domain role", REGISTRY_SERVICE_ROLE
+    // 2). Keep onlyReleaseRegistry modifier
+    // 3). Delete onlyRegistryService in favor of restricted
     // 4). (For GlobalRegistry ONLY) make registerChainRegistry() restricted to GIF_ADMIN_ROLE
     modifier onlyRegistryService() {
-        if(!_releaseManager.isActiveRegistryService(msg.sender)) {
+        if(!_releaseRegistry.isActiveRegistryService(msg.sender)) {
             revert ErrorRegistryCallerNotRegistryService();
         }
         _;
     }
 
 
-    modifier onlyReleaseManager() {
-        if(msg.sender != address(_releaseManager)) {
-            revert ErrorRegistryCallerNotReleaseManager();
+    modifier onlyReleaseRegistry() {
+        if(msg.sender != address(_releaseRegistry)) {
+            revert ErrorRegistryCallerNotReleaseRegistry();
         }
         _;
     }
 
-
+    /// @dev Creates the registry contract and populates it with the protocol and registry objects.
+    /// Internally deploys the ChainNft contract.
     constructor(RegistryAdmin admin) 
         InitializableCustom() 
     {
@@ -98,91 +101,98 @@ contract Registry is
     }
 
 
-    /// @dev wires release manager and token to registry (this contract).
-    /// MUST be called by release manager.
+    /// @dev Wires release registry and token to registry (this contract).
+    /// MUST be called by release registry.
     function initialize(
-        address releaseManager,
+        address releaseRegistry,
         address tokenRegistry,
         address staking
     )
         external
         initializer()
     {
-        _releaseManager = ReleaseManager(releaseManager);
+        _releaseRegistry = ReleaseRegistry(releaseRegistry);
         _tokenRegistryAddress = tokenRegistry;
         _stakingAddress = staking;
 
         _stakingNftId = _registerStaking();
     }
 
+    /// @inheritdoc IRegistry
+    function register(ObjectInfo memory info)
+        external
+        onlyRegistryService
+        returns(NftId nftId)
+    {
+        ObjectType objectType = info.objectType;
+        ObjectType parentType = _info[info.parentNftId].objectType;
+
+        // check type combinations for core objects
+        if(info.objectAddress == address(0)) {
+            if(_coreObjectCombinations[objectType][parentType] == false) {
+                revert ErrorRegistryTypesCombinationInvalid(objectType, parentType);
+            }
+        }
+        // check type combinations for contract objects
+        else {
+            if(_coreContractCombinations[objectType][parentType] == false) {
+                revert ErrorRegistryTypesCombinationInvalid(objectType, parentType);
+            }
+        }
+
+        nftId = _register(info);
+    }
+
+
+    /// @inheritdoc IRegistry
     function registerService(
         ObjectInfo memory info, 
         VersionPart version, 
         ObjectType domain
     )
         external
-        onlyReleaseManager
+        onlyReleaseRegistry
         returns(NftId nftId)
     {
+        // check service address is defined
         address service = info.objectAddress;
-        /* must be guaranteed by release manager
         if(service == address(0)) {
-            revert();
+            revert ErrorRegistryServiceAddressZero();
         }
 
+        // check version is defined
         if(version.eqz()) {
-            revert();
+            revert ErrorRegistryServiceVersionZero();
         }
 
-        if(info.objectType != SERVICE()) {
-            revert();
-        }
-        if(info.parentType != REGISTRY()) {
-            revert();
-        }        
-        info.initialOwner == NFT_LOCK_ADDRESS <- if services are access managed
-        */
-
+        // check domain is defined
         if(domain.eqz()) {
             revert ErrorRegistryDomainZero(service);
         }
 
-        if(_service[version][domain] > address(0)) {
+        // check contract has not already been registered
+        if(_service[version][domain] != address(0)) {
             revert ErrorRegistryDomainAlreadyRegistered(service, version, domain);
         }
-        
-        _service[version][domain] = service;
 
+        // check service has proper type
+        if(info.objectType != SERVICE()) {
+            revert ErrorRegistryNotService(service, info.objectType);
+        }
+
+        // check that parent has registry type
+        if(info.parentNftId != _registryNftId) {
+            revert ErrorRegistryServiceParentNotRegistry(info.parentNftId);
+        }        
+
+        _service[version][domain] = service;
         nftId = _register(info);
 
         emit LogServiceRegistration(version, domain);
     }
 
-    function register(ObjectInfo memory info)
-        external
-        onlyRegistryService
-        returns(NftId nftId)
-    {
-        ObjectType objectType = info.objectType;
-        ObjectType parentType = _info[info.parentNftId].objectType;
-
-        // only valid core types combinations
-        if(info.objectAddress == address(0)) 
-        {
-            if(_coreObjectCombinations[objectType][parentType] == false) {
-                revert ErrorRegistryTypesCombinationInvalid(objectType, parentType);
-            }
-        }
-        else
-        {
-            if(_coreContractCombinations[objectType][parentType] == false) {
-                revert ErrorRegistryTypesCombinationInvalid(objectType, parentType);
-            }
-        }
-
-        nftId = _register(info);
-    }
 
+    /// @inheritdoc IRegistry
     function registerWithCustomType(ObjectInfo memory info)
         external
         onlyRegistryService
@@ -197,7 +207,6 @@ contract Registry is
 
         if(
             parentType == PROTOCOL() ||
-            parentType == REGISTRY() ||
             parentType == SERVICE()
         ) {
             revert ErrorRegistryTypesCombinationInvalid(objectType, parentType);
@@ -209,21 +218,21 @@ contract Registry is
 
     /// @dev earliest GIF major version 
     function getInitialVersion() external view returns (VersionPart) {
-        return _releaseManager.getInitialVersion();
+        return _releaseRegistry.getInitialVersion();
     }
 
     /// @dev next GIF release version to be released
     function getNextVersion() external view returns (VersionPart) {
-        return _releaseManager.getNextVersion();
+        return _releaseRegistry.getNextVersion();
     }
 
     /// @dev latest active GIF release version 
     function getLatestVersion() external view returns (VersionPart) { 
-        return _releaseManager.getLatestVersion();
+        return _releaseRegistry.getLatestVersion();
     }
 
     function getReleaseInfo(VersionPart version) external view returns (ReleaseInfo memory) {
-        return _releaseManager.getReleaseInfo(version);
+        return _releaseRegistry.getReleaseInfo(version);
     }
 
     function getObjectCount() external view returns (uint256) {
@@ -277,7 +286,7 @@ contract Registry is
 
     function isActiveRelease(VersionPart version) external view returns (bool)
     {
-        return _releaseManager.isActiveRelease(version);
+        return _releaseRegistry.isActiveRelease(version);
     }
 
     function getStakingAddress() external view returns (address staking) {
@@ -298,12 +307,8 @@ contract Registry is
         service =  _service[releaseVersion][serviceDomain]; 
     }
 
-    function getReleaseAccessManagerAddress(VersionPart version) external view returns (address) {
-        return address(_releaseManager.getReleaseAccessManager(version));
-    }
-
-    function getReleaseManagerAddress() external view returns (address) {
-        return address(_releaseManager);
+    function getReleaseRegistryAddress() external view returns (address) {
+        return address(_releaseRegistry);
     }
 
     function getChainNftAddress() external view override returns (address) {
@@ -335,7 +340,6 @@ contract Registry is
     // Internals
 
     /// @dev registry protects only against tampering existing records, registering with invalid types pairs and 0 parent address
-    // TODO registration of precompile addresses
     function _register(ObjectInfo memory info)
         internal
         returns(NftId nftId)
@@ -522,22 +526,18 @@ contract Registry is
         });
 
         _nftIdByAddress[_stakingAddress] = stakingNftId;
+
         // reverts if nftId was already minted
         _chainNft.mint(stakingOwner, stakingId);
     }
 
     /// @dev defines which object - parent types relations are allowed to register
-    // IMPORTANT: 
-    // 1) EACH object type MUST have only one parent type across ALL mappings
-    // 2) DO NOT use object type (e.g. POLCY, BUNDLE, STAKE) as parent type
-    // 3) DO NOT use REGISTRY as object type
-    // 2) DO NOT use PROTOCOL and "ObjectTypeLib.zero"
+    /// EACH object type MUST have only one parent type across ALL mappings
     function _setupValidCoreTypesAndCombinations() 
         private 
     {
         _coreTypes[REGISTRY()] = true;
         _coreTypes[SERVICE()] = true;
-        _coreTypes[TOKEN()] = true;
         _coreTypes[INSTANCE()] = true;
         _coreTypes[PRODUCT()] = true;
         _coreTypes[POOL()] = true;
@@ -549,28 +549,22 @@ contract Registry is
         _coreTypes[STAKING()] = true;
         _coreTypes[STAKE()] = true;
 
-        uint256 registryId = _chainNft.calculateTokenId(REGISTRY_TOKEN_SEQUENCE_ID);
-        if(registryId == _chainNft.GLOBAL_REGISTRY_ID()) {
-            // we are global registry
-            // object is registry from different chain
-            // parent is global registry, this contract
-            _coreContractCombinations[REGISTRY()][REGISTRY()] = true; // only for global regstry
-            //_coreObjectCombinations[REGISTRY()][REGISTRY()] = true;
-        } else {
-            // we are not global registry
-            // object is local registry, this contract
-            // parent is global registry, object with 0 address or registry from mainnet???
+        // only global registry allowed to register registry (after initialization)
+        if(block.chainid == 1) {
+            _coreContractCombinations[REGISTRY()][REGISTRY()] = true;
         }
+
+        // contracts with registry parent
         _coreContractCombinations[STAKING()][REGISTRY()] = true; // only for chain staking contract
-        _coreContractCombinations[TOKEN()][REGISTRY()] = true;
-        //_coreContractCombinations[SERVICE()][REGISTRY()] = true;// do not need it here -> registerService() registers exactly this combination
         _coreContractCombinations[INSTANCE()][REGISTRY()] = true;
 
+        // components with instance parent
         _coreContractCombinations[PRODUCT()][INSTANCE()] = true;
         _coreContractCombinations[DISTRIBUTION()][INSTANCE()] = true;
         _coreContractCombinations[ORACLE()][INSTANCE()] = true;
         _coreContractCombinations[POOL()][INSTANCE()] = true;
 
+        // objects with coponent parents
         _coreObjectCombinations[DISTRIBUTOR()][DISTRIBUTION()] = true;
         _coreObjectCombinations[POLICY()][PRODUCT()] = true;
         _coreObjectCombinations[BUNDLE()][POOL()] = true;

package/contracts/registry/RegistryAdmin.sol

@@ -1,17 +1,18 @@
 // SPDX-License-Identifier: UNLICENSED
 pragma solidity ^0.8.20;
 
-import {AccessAdmin} from "../shared/AccessAdmin.sol";
-import {IAccessAdmin} from "../shared/IAccessAdmin.sol";
+import {AccessAdmin} from "../authorization/AccessAdmin.sol";
+import {IAccess} from "../authorization/IAccess.sol";
 import {IRegistry} from "./IRegistry.sol";
 import {IService} from "../shared/IService.sol";
-import {IServiceAuthorization} from "./IServiceAuthorization.sol";
+import {IServiceAuthorization} from "../authorization/IServiceAuthorization.sol";
 import {IStaking} from "../staking/IStaking.sol";
 import {ObjectType, ObjectTypeLib, ALL, POOL, RELEASE} from "../type/ObjectType.sol";
-import {ReleaseManager} from "./ReleaseManager.sol";
+import {ReleaseRegistry} from "./ReleaseRegistry.sol";
 import {RoleId, RoleIdLib, ADMIN_ROLE, GIF_MANAGER_ROLE, GIF_ADMIN_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
 import {StakingStore} from "../staking/StakingStore.sol";
 import {STAKING} from "../type/ObjectType.sol";
+import {TokenHandler} from "../shared/TokenHandler.sol";
 import {TokenRegistry} from "./TokenRegistry.sol";
 import {VersionPart} from "../type/Version.sol";
 
@@ -38,17 +39,21 @@ contract RegistryAdmin is
 
     string public constant GIF_ADMIN_ROLE_NAME = "GifAdminRole";
     string public constant GIF_MANAGER_ROLE_NAME = "GifManagerRole";
-    string public constant STAKING_SERVICE_ROLE_NAME = "StakingServiceRole";
     string public constant POOL_SERVICE_ROLE_NAME = "PoolServiceRole";
+    string public constant RELEASE_REGISTRY_ROLE_NAME = "ReleaseRegistryRole";
+    string public constant STAKING_SERVICE_ROLE_NAME = "StakingServiceRole";
+    string public constant STAKING_ROLE_NAME = "StakingRole";
 
-    string public constant RELEASE_MANAGER_TARGET_NAME = "ReleaseManagerTarget";
-    string public constant TOKEN_REGISTRY_TARGET_NAME = "TokenRegistryTarget";
-    string public constant STAKING_TARGET_NAME = "StakingTarget";
-    string public constant STAKING_STORE_TARGET_NAME = "StakingStoreTarget";
+    string public constant RELEASE_REGISTRY_TARGET_NAME = "ReleaseRegistry";
+    string public constant TOKEN_REGISTRY_TARGET_NAME = "TokenRegistry";
+    string public constant STAKING_TARGET_NAME = "Staking";
+    string public constant STAKING_STORE_TARGET_NAME = "StakingStore";
+
+    uint8 public constant MAX_NUM_RELEASES = 99;
 
     mapping(address service => VersionPart majorVersion) private _ServiceRelease;
 
-    address private _releaseManager;
+    address private _releaseRegistry;
     address private _tokenRegistry;
     address private _staking;
     address private _stakingStore;
@@ -67,19 +72,19 @@ contract RegistryAdmin is
         if (_setupCompleted) { revert ErrorRegistryAdminIsAlreadySetUp(); } 
         else { _setupCompleted = true; }
 
-        _releaseManager = registry.getReleaseManagerAddress();
+        _releaseRegistry = registry.getReleaseRegistryAddress();
         _tokenRegistry = registry.getTokenRegistryAddress();
         _staking = registry.getStakingAddress();
         _stakingStore = address(
             IStaking(_staking).getStakingStore());
 
         // at this moment all registry contracts are deployed and fully intialized
-        _createTarget(_tokenRegistry, TOKEN_REGISTRY_TARGET_NAME);
+        _createTarget(_tokenRegistry, TOKEN_REGISTRY_TARGET_NAME, true, false);
 
         _setupGifAdminRole(gifAdmin);
         _setupGifManagerRole(gifManager);
 
-        _setupReleaseManager();
+        _setupReleaseRegistry();
         _setupStaking();
     }
 
@@ -112,50 +117,39 @@ contract RegistryAdmin is
     function _createServiceTargetAndRole(IService service)
         private
     {
-        ObjectType domain = service.getDomain();
-        string memory baseName = ObjectTypeLib.toName(domain);
+        ObjectType serviceDomain = service.getDomain();
+        string memory baseName = ObjectTypeLib.toName(serviceDomain);
         VersionPart version = service.getVersion().toMajorPart();
         uint256 versionInt = version.toInt();
-        string memory versionName = "_v0";
-        string memory versionNumber = ObjectTypeLib.toString(versionInt);
-
-        if (versionInt >= 10) {
-            versionName = "_v";
-        }
 
         // create service target
-        string memory serviceTargetName = string(
-            abi.encodePacked(
-                baseName,
-                "Service",
-                versionName,
-                versionNumber));
+        string memory serviceTargetName = ObjectTypeLib.toVersionedName(
+            baseName, "Service", versionInt);
 
         _createTarget(
             address(service), 
-            serviceTargetName);
+            serviceTargetName,
+            true,
+            false);
 
         // create service role
-        string memory serviceRoleName = string(
-            abi.encodePacked(
-                baseName,
-                "ServiceRole",
-                versionName,
-                versionNumber));
-
-        RoleId roleId = RoleIdLib.roleForTypeAndVersion(
-            domain, 
+        RoleId serviceRoleId = RoleIdLib.roleForTypeAndVersion(
+            serviceDomain, 
             version);
 
         _createRole(
-            roleId, 
-            ADMIN_ROLE(), 
-            serviceRoleName,
-            1, // service roles must only be given to this unique service
-            true); // it must not be possible to remove this role once granted
+            serviceRoleId, 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: 1,
+                name: ObjectTypeLib.toVersionedName(
+                    baseName, 
+                    "ServiceRole", 
+                    versionInt)}));
 
         _grantRoleToAccount( 
-            roleId,
+            serviceRoleId,
             address(service)); 
     }
 
@@ -186,7 +180,7 @@ contract RegistryAdmin is
             }
 
             // get authorized functions for authorized domain
-            IAccessAdmin.Function[] memory authorizatedFunctions = serviceAuthorization.getAuthorizedFunctions(
+            IAccess.FunctionInfo[] memory authorizatedFunctions = serviceAuthorization.getAuthorizedFunctions(
                 serviceDomain, 
                 authorizedDomain);
 
@@ -218,27 +212,40 @@ contract RegistryAdmin is
     //--- private functions -------------------------------------------------//
 
     function _setupGifAdminRole(address gifAdmin) private {
-        // TODO decide on max member count
-        _createRole(GIF_ADMIN_ROLE(), getAdminRole(), GIF_ADMIN_ROLE_NAME, 2, false);
-        _grantRoleToAccount(GIF_ADMIN_ROLE(), gifAdmin);
-
-        // for ReleaseManager
-        Function[] memory functions;
-        functions = new Function[](2);
-        functions[0] = toFunction(ReleaseManager.createNextRelease.selector, "createNextRelease");
-        functions[1] = toFunction(ReleaseManager.activateNextRelease.selector, "activateNextRelease");
-        _authorizeTargetFunctions(_releaseManager, GIF_ADMIN_ROLE(), functions);
+        
+        _createRole(
+            GIF_ADMIN_ROLE(), 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Gif,
+                maxMemberCount: 2, // TODO decide on max member count
+                name: GIF_ADMIN_ROLE_NAME}));
+
+        // for ReleaseRegistry
+        FunctionInfo[] memory functions;
+        functions = new FunctionInfo[](4);
+        functions[0] = toFunction(ReleaseRegistry.createNextRelease.selector, "createNextRelease");
+        functions[1] = toFunction(ReleaseRegistry.activateNextRelease.selector, "activateNextRelease");
+        functions[2] = toFunction(ReleaseRegistry.pauseRelease.selector, "pauseRelease");
+        functions[3] = toFunction(ReleaseRegistry.unpauseRelease.selector, "unpauseRelease");
+        _authorizeTargetFunctions(_releaseRegistry, GIF_ADMIN_ROLE(), functions);
 
-        // for Staking
+        _grantRoleToAccount(GIF_ADMIN_ROLE(), gifAdmin);
     }
     
     function _setupGifManagerRole(address gifManager) private {
-        _createRole(GIF_MANAGER_ROLE(), GIF_ADMIN_ROLE(), GIF_MANAGER_ROLE_NAME, 1, false);
-        _grantRoleToAccount(GIF_MANAGER_ROLE(), gifManager);
+
+        _createRole(
+            GIF_MANAGER_ROLE(), 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Gif,
+                maxMemberCount: 1,
+                name: GIF_MANAGER_ROLE_NAME}));
 
         // for TokenRegistry
-        Function[] memory functions;
-        functions = new Function[](5);
+        FunctionInfo[] memory functions;
+        functions = new FunctionInfo[](5);
         functions[0] = toFunction(TokenRegistry.registerToken.selector, "registerToken");
         functions[1] = toFunction(TokenRegistry.registerRemoteToken.selector, "registerRemoteToken");
         functions[2] = toFunction(TokenRegistry.setActive.selector, "setActive");
@@ -247,42 +254,55 @@ contract RegistryAdmin is
         functions[4] = toFunction(TokenRegistry.setActiveWithVersionCheck.selector, "setActiveWithVersionCheck");
         _authorizeTargetFunctions(_tokenRegistry, GIF_MANAGER_ROLE(), functions);
 
-        // for ReleaseManager
-        functions = new Function[](2);
-        functions[0] = toFunction(ReleaseManager.prepareNextRelease.selector, "prepareNextRelease");
-        functions[1] = toFunction(ReleaseManager.registerService.selector, "registerService");
-        _authorizeTargetFunctions(_releaseManager, GIF_MANAGER_ROLE(), functions);
+        // for ReleaseRegistry
+        functions = new FunctionInfo[](2);
+        functions[0] = toFunction(ReleaseRegistry.prepareNextRelease.selector, "prepareNextRelease");
+        functions[1] = toFunction(ReleaseRegistry.registerService.selector, "registerService");
+        _authorizeTargetFunctions(_releaseRegistry, GIF_MANAGER_ROLE(), functions);
 
-        // for Staking
+        _grantRoleToAccount(GIF_MANAGER_ROLE(), gifManager);
     }
 
 
-    function _setupReleaseManager() private {
-        _createTarget(_releaseManager, RELEASE_MANAGER_TARGET_NAME);
+    function _setupReleaseRegistry() private {
 
-        RoleId releaseManagerRoleId = RoleIdLib.roleForType(RELEASE());
-        _createRole(releaseManagerRoleId, ADMIN_ROLE(), RELEASE_MANAGER_TARGET_NAME, 1, true);
-        _grantRoleToAccount(releaseManagerRoleId, _releaseManager);
+        _createTarget(_releaseRegistry, RELEASE_REGISTRY_TARGET_NAME, true, false);
 
-        Function[] memory functions;
-        functions = new Function[](2);
+        RoleId releaseRegistryRoleId = RoleIdLib.roleForType(RELEASE());
+        _createRole(
+            releaseRegistryRoleId, 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: 1,
+                name: RELEASE_REGISTRY_ROLE_NAME}));
+
+        FunctionInfo[] memory functions;
+        functions = new FunctionInfo[](2);
         functions[0] = toFunction(RegistryAdmin.authorizeService.selector, "authorizeService");
         functions[1] = toFunction(RegistryAdmin.grantServiceRoleForAllVersions.selector, "grantServiceRoleForAllVersions");
-        _authorizeTargetFunctions(address(this), releaseManagerRoleId, functions);
+        _authorizeTargetFunctions(address(this), releaseRegistryRoleId, functions);
+
+        _grantRoleToAccount(releaseRegistryRoleId, _releaseRegistry);
     }
 
 
     function _setupStaking() private {
-        _createTarget(_staking, STAKING_TARGET_NAME);
-        _createTarget(_stakingStore, STAKING_STORE_TARGET_NAME);
-
+        _createTarget(_staking, STAKING_TARGET_NAME, true, false);
+        _createTarget(_stakingStore, STAKING_STORE_TARGET_NAME, true, false);
 
         // staking function authorization for staking service
         RoleId stakingServiceRoleId = RoleIdLib.roleForTypeAndAllVersions(STAKING());
-        _createRole(stakingServiceRoleId, ADMIN_ROLE(), STAKING_SERVICE_ROLE_NAME, 1, true);
-
-        Function[] memory functions;
-        functions = new Function[](13);
+        _createRole(
+            stakingServiceRoleId, 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: MAX_NUM_RELEASES,
+                name: STAKING_SERVICE_ROLE_NAME}));
+
+        FunctionInfo[] memory functions;
+        functions = new FunctionInfo[](13);
         functions[0] = toFunction(IStaking.registerTarget.selector, "registerTarget");
         functions[1] = toFunction(IStaking.setLockingPeriod.selector, "setLockingPeriod");
         functions[2] = toFunction(IStaking.setRewardRate.selector, "setRewardRate");
@@ -300,20 +320,31 @@ contract RegistryAdmin is
 
         // staking function authorization for pool service
         RoleId poolServiceRoleId = RoleIdLib.roleForTypeAndAllVersions(POOL());
-        _createRole(poolServiceRoleId, ADMIN_ROLE(), POOL_SERVICE_ROLE_NAME, 1, true);
+        _createRole(
+            poolServiceRoleId, 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: MAX_NUM_RELEASES,
+                name: POOL_SERVICE_ROLE_NAME}));
 
         // staking function authorizations
-        functions = new Function[](2);
+        functions = new FunctionInfo[](2);
         functions[0] = toFunction(IStaking.increaseTotalValueLocked.selector, "increaseTotalValueLocked");
         functions[1] = toFunction(IStaking.decreaseTotalValueLocked.selector, "decreaseTotalValueLocked");
         _authorizeTargetFunctions(_staking, poolServiceRoleId, functions);
 
         // staking store function authorizations
         RoleId stakingRoleId = RoleIdLib.roleForType(STAKING());
-        _createRole(stakingRoleId, ADMIN_ROLE(), STAKING_TARGET_NAME, 1, true);
-        _grantRoleToAccount(stakingRoleId, _staking);
-
-        functions = new Function[](14);
+        _createRole(
+            stakingRoleId, 
+            toRole({
+                adminRoleId: ADMIN_ROLE(),
+                roleType: RoleType.Contract,
+                maxMemberCount: 1,
+                name: STAKING_ROLE_NAME}));
+
+        functions = new FunctionInfo[](14);
         functions[0] = toFunction(StakingStore.setStakingRate.selector, "setStakingRate");
         functions[1] = toFunction(StakingStore.createTarget.selector, "createTarget");
         functions[2] = toFunction(StakingStore.updateTarget.selector, "updateTarget");
@@ -329,5 +360,15 @@ contract RegistryAdmin is
         functions[12] = toFunction(StakingStore.claimUpTo.selector, "claimUpTo");
         functions[13] = toFunction(StakingStore.unstakeUpTo.selector, "unstakeUpTo");
         _authorizeTargetFunctions(_stakingStore, stakingRoleId, functions);
+        
+        _grantRoleToAccount(stakingRoleId, _staking);
+    
+        // grant token handler authorizations
+        IStaking staking = IStaking(_staking);
+        functions = new FunctionInfo[](2);
+        functions[0] = toFunction(TokenHandler.collectTokens.selector, "collectTokens");
+        functions[1] = toFunction(TokenHandler.distributeTokens.selector, "distributeTokens");
+        
+        _authorizeTargetFunctions(address(staking.getTokenHandler()), stakingRoleId, functions);
     }
 }