@etherisc/gif-next 0.0.2-fd4931b-974 → 0.0.2-fd4ee14-428

package/contracts/registry/ServiceAuthorization.sol

@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IAccessAdmin} from "../shared/IAccessAdmin.sol";
+import {ObjectType} from "../../contracts/type/ObjectType.sol";
+import {IServiceAuthorization} from "./IServiceAuthorization.sol";
+import {SelectorLib} from "../../contracts/type/Selector.sol";
+import {StrLib} from "../../contracts/type/String.sol";
+import {VersionPart, VersionPartLib} from "../../contracts/type/Version.sol";
+
+/// @dev Base contract for release specific service authorization contracts.
+contract ServiceAuthorization
+     is IServiceAuthorization
+{
+     uint256 public constant GIF_VERSION = 3;
+
+     string private _commitHash;
+
+     ObjectType[] internal _serviceDomains;
+     mapping(ObjectType domain => address service) internal _serviceAddress;
+     mapping(ObjectType domain => ObjectType[] authorizedDomains) internal _authorizedDomains;
+     mapping(ObjectType domain => mapping(ObjectType authorizedDomain => IAccessAdmin.Function[] functions)) internal _authorizedFunctions;
+
+     constructor(string memory commitHash) {
+          _commitHash = commitHash;
+          _setupDomains();
+          _setupDomainAuthorizations();
+     }
+
+     function getCommitHash() external view returns(string memory commitHash) {
+          return _commitHash;
+     }
+
+     function getRelease() external view returns(VersionPart release, uint domainsCount) {
+          return (
+               VersionPartLib.toVersionPart(GIF_VERSION),
+               _serviceDomains.length
+          );
+     }
+
+     function getServiceDomains() external view returns(ObjectType[] memory serviceDomains) {
+          return _serviceDomains;
+     }
+
+     function getServiceAddress(ObjectType serviceDomain) external view returns(address service) {
+          return _serviceAddress[serviceDomain];
+     }
+
+     function getAuthorizedDomains(ObjectType serviceDomain) external view returns(ObjectType[] memory authorizatedDomains) {
+          return _authorizedDomains[serviceDomain];
+     }
+
+     function getAuthorizedFunctions(ObjectType serviceDomain, ObjectType authorizedDomain) external view returns(IAccessAdmin.Function[] memory authorizatedFunctions) {
+          return _authorizedFunctions[serviceDomain][authorizedDomain];
+     }
+
+     /// @dev Overwrite this function for a specific realease.
+     function _setupDomains() internal virtual {}
+
+     /// @dev Overwrite this function for a specific realease.
+     function _setupDomainAuthorizations() internal virtual {}
+
+     /// @dev Use this method to to add an authorized domain.
+     /// The services will need to be registered in the order they are added using this function.
+     function _authorizeDomain(ObjectType serviceDomain, address serviceAddress) internal {
+          _serviceDomains.push(serviceDomain);
+          _serviceAddress[serviceDomain] = serviceAddress;
+     }
+
+     function _authorizeForService(ObjectType serviceDomain, ObjectType authorizedDomain)
+          internal
+          returns (IAccessAdmin.Function[] storage authorizatedFunctions)
+     {
+          _authorizedDomains[serviceDomain].push(authorizedDomain);
+          return _authorizedFunctions[serviceDomain][authorizedDomain];
+     }
+
+     /// @dev Use this method to authorize a specific function authorization
+     function _authorize(IAccessAdmin.Function[] storage functions, bytes4 selector, string memory name) internal {
+          functions.push(
+               IAccessAdmin.Function({
+                    selector: SelectorLib.toSelector(selector),
+                    name: StrLib.toStr(name)}));
+     }
+}
+

package/contracts/registry/ServiceAuthorizationV3.sol

@@ -0,0 +1,200 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {
+     ALL, REGISTRY, SERVICE, PRODUCT, ORACLE, POOL, INSTANCE, COMPONENT, DISTRIBUTION, DISTRIBUTOR, APPLICATION, POLICY, CLAIM, BUNDLE, STAKE, STAKING, PRICE
+} from "../../contracts/type/ObjectType.sol";
+
+import {ComponentService} from "../shared/ComponentService.sol";
+import {IAccessAdmin} from "../shared/IAccessAdmin.sol";
+import {IBundleService} from "../pool/IBundleService.sol";
+import {IDistributionService} from "../distribution/IDistributionService.sol";
+import {InstanceService} from "../instance/InstanceService.sol";
+import {IInstanceService} from "../instance/IInstanceService.sol";
+import {IPoolService} from "../pool/IPoolService.sol";
+import {IStakingService} from "../staking/IStakingService.sol";
+import {IRegistryService} from "./IRegistryService.sol";
+import {ServiceAuthorization} from "./ServiceAuthorization.sol";
+
+
+contract ServiceAuthorizationV3
+     is ServiceAuthorization
+{
+
+     constructor(string memory commitHash)
+          ServiceAuthorization(commitHash)
+     {}
+
+     function _setupDomains()
+          internal
+          override
+     {
+          _authorizeDomain(REGISTRY(), address(1));
+          _authorizeDomain(STAKING(), address(2));
+          _authorizeDomain(INSTANCE(), address(3));
+          _authorizeDomain(COMPONENT(), address(4));
+          _authorizeDomain(DISTRIBUTION(), address(5));
+          _authorizeDomain(PRICE(), address(6));
+          _authorizeDomain(BUNDLE(), address(7));
+          _authorizeDomain(POOL(), address(8));
+          _authorizeDomain(ORACLE(), address(9));
+          _authorizeDomain(PRODUCT(), address(10));
+          _authorizeDomain(CLAIM(), address(11));
+          _authorizeDomain(APPLICATION(), address(12));
+          _authorizeDomain(POLICY(), address(13));
+     }
+
+
+     function _setupDomainAuthorizations()
+          internal
+          override
+     {
+          _setupIRegistryServiceAuthorization();
+          _setupStakingServiceAuthorization();
+          _setupInstanceServiceAuthorization();
+          _setupComponentServiceAuthorization();
+          _setupDistributionServiceAuthorization();
+          _setupPoolServiceAuthorization();
+          _setupBundleServiceAuthorization();
+     }
+
+
+     /// @dev registry service authorization.
+     /// authorized functions MUST be implemented with a restricted modifier
+     function _setupIRegistryServiceAuthorization()
+          internal
+     {
+          IAccessAdmin.Function[] storage functions;
+
+          functions = _authorizeForService(REGISTRY(), APPLICATION());
+          _authorize(functions, IRegistryService.registerPolicy.selector, "registerPolicy");
+
+          functions = _authorizeForService(REGISTRY(), POOL());
+          _authorize(functions, IRegistryService.registerPool.selector, "registerPool");
+
+          functions = _authorizeForService(REGISTRY(), BUNDLE());
+          _authorize(functions, IRegistryService.registerBundle.selector, "registerBundle");
+
+          functions = _authorizeForService(REGISTRY(), DISTRIBUTION());
+          _authorize(functions, IRegistryService.registerDistribution.selector, "registerDistribution");
+          _authorize(functions, IRegistryService.registerDistributor.selector, "registerDistributor");
+
+          functions = _authorizeForService(REGISTRY(), COMPONENT());
+          _authorize(functions, IRegistryService.registerComponent.selector, "registerComponent");
+
+          functions = _authorizeForService(REGISTRY(), INSTANCE());
+          _authorize(functions, IRegistryService.registerInstance.selector, "registerInstance");
+
+          functions = _authorizeForService(REGISTRY(), STAKING());
+          _authorize(functions, IRegistryService.registerStake.selector, "registerStake");
+
+          functions = _authorizeForService(REGISTRY(), PRODUCT());
+          _authorize(functions, IRegistryService.registerProduct.selector, "registerProduct");
+     }
+
+
+     /// @dev staking service authorization.
+     /// authorized functions MUST be implemented with a restricted modifier
+     function _setupStakingServiceAuthorization()
+          internal
+     {
+          IAccessAdmin.Function[] storage functions;
+
+          functions = _authorizeForService(STAKING(), INSTANCE());
+          _authorize(functions, IStakingService.createInstanceTarget.selector, "createInstanceTarget");
+          _authorize(functions, IStakingService.setInstanceLockingPeriod.selector, "setInstanceLockingPeriod");
+          _authorize(functions, IStakingService.setInstanceRewardRate.selector, "setInstanceRewardRate");
+          _authorize(functions, IStakingService.refillInstanceRewardReserves.selector, "refillInstanceRewardReserves");
+          _authorize(functions, IStakingService.withdrawInstanceRewardReserves.selector, "withdrawInstanceRewardReserves");
+
+          functions = _authorizeForService(STAKING(), ALL());
+          _authorize(functions, IStakingService.create.selector, "create");
+          _authorize(functions, IStakingService.stake.selector, "stake");
+          _authorize(functions, IStakingService.restakeToNewTarget.selector, "restakeToNewTarget");
+          _authorize(functions, IStakingService.updateRewards.selector, "updateRewards");
+          _authorize(functions, IStakingService.claimRewards.selector, "claimRewards");
+          _authorize(functions, IStakingService.unstake.selector, "unstake");
+     }
+
+
+     /// @dev Instance service function authorization.
+     function _setupInstanceServiceAuthorization()
+          internal
+     {
+          IAccessAdmin.Function[] storage functions;
+
+          functions = _authorizeForService(INSTANCE(), COMPONENT());
+          _authorize(functions, IInstanceService.createComponentTarget.selector, "createComponentTarget");
+     }
+
+
+     /// @dev Component service function authorization.
+     function _setupComponentServiceAuthorization()
+          internal
+     {
+          // authz.authorizations = new DomainAuthorization[](4);
+
+          // authz.authorizations[0].domain = POLICY();
+          // _functions = new IAccessAdmin.Function[](1);
+          // __authorize(ComponentService.increaseProductFees.selector, "increaseProductFees"));
+          // authz.authorizations[0].functions = _functions;
+
+          // authz.authorizations[1].domain = DISTRIBUTION();
+          // _functions = new IAccessAdmin.Function[](1);
+          // __authorize(ComponentService.increaseDistributionBalance.selector, "increaseDistributionBalance"));
+          // authz.authorizations[1].functions = _functions;
+
+          // authz.authorizations[2].domain = POOL();
+          // _functions = new IAccessAdmin.Function[](1);
+          // __authorize(ComponentService.increasePoolBalance.selector, "increasePoolBalance"));
+          // authz.authorizations[2].functions = _functions;
+
+          // authz.authorizations[3].domain = BUNDLE();
+          // _functions = new IAccessAdmin.Function[](1);
+          // __authorize(ComponentService.increaseBundleBalance.selector, "increaseBundleBalance"));
+          // authz.authorizations[3].functions = _functions;
+     }
+
+     /// @dev Distribution service function authorization.
+     function _setupDistributionServiceAuthorization()
+          internal
+     {
+          IAccessAdmin.Function[] storage functions;
+
+          functions = _authorizeForService(DISTRIBUTION(), POLICY());
+          _authorize(functions, IDistributionService.processSale.selector, "processSale");
+     }
+
+
+     /// @dev Pool service function authorization.
+     function _setupPoolServiceAuthorization()
+          internal
+     {
+          IAccessAdmin.Function[] storage functions;
+
+          functions = _authorizeForService(POOL(), POLICY());
+          _authorize(functions, IPoolService.lockCollateral.selector, "lockCollateral");
+          _authorize(functions, IPoolService.releaseCollateral.selector, "releaseCollateral");
+          _authorize(functions, IPoolService.reduceCollateral.selector, "reduceCollateral");
+          _authorize(functions, IPoolService.processSale.selector, "processSale");
+
+          functions = _authorizeForService(POOL(), CLAIM());
+          _authorize(functions, IPoolService.reduceCollateral.selector, "reduceCollateral");
+     }
+
+
+     /// @dev Instance service function authorization.
+     function _setupBundleServiceAuthorization()
+          internal
+     {
+          IAccessAdmin.Function[] storage functions;
+
+          functions = _authorizeForService(BUNDLE(), POOL());
+          _authorize(functions, IBundleService.create.selector, "create");
+          _authorize(functions, IBundleService.close.selector, "close");
+          _authorize(functions, IBundleService.lockCollateral.selector, "lockCollateral");
+          _authorize(functions, IBundleService.releaseCollateral.selector, "releaseCollateral");
+          _authorize(functions, IBundleService.unlinkPolicy.selector, "unlinkPolicy");
+     }
+}
+

package/contracts/registry/TokenRegistry.sol

@@ -1,19 +1,25 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {AccessManaged} from "@openzeppelin/contracts/access/manager/AccessManaged.sol";
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
 import {ERC165Checker} from "@openzeppelin/contracts/utils/introspection/ERC165Checker.sol";
 
+import {REGISTRY} from "../type/ObjectType.sol";
+import {VersionPart} from "../type/Version.sol";
+
 import {IRegisterable} from "../shared/IRegisterable.sol";
+
 import {IRegistry} from "./IRegistry.sol";
-import {NftOwnable} from "../shared/NftOwnable.sol";
+import {IRegistryLinked} from "../shared/IRegistryLinked.sol";
 import {ReleaseManager} from "./ReleaseManager.sol";
-import {REGISTRY} from "../type/ObjectType.sol";
-import {VersionPart} from "../type/Version.sol";
+import {RegistryAdmin} from "./RegistryAdmin.sol";
+
 
 /// @title contract to register token per GIF major release.
 contract TokenRegistry is
-    NftOwnable
+    AccessManaged,
+    IRegistryLinked
 {
     event LogTokenRegistryTokenRegistered(uint256 chainId, address token, uint256 decimals, string symbol);
     event LogTokenRegistryTokenGlobalStateSet(uint256 chainId, address token, bool active);
@@ -42,6 +48,7 @@ contract TokenRegistry is
     mapping(uint256 chainId => mapping(address token => mapping(VersionPart majorVersion => bool isActive))) internal _active;
     TokenInfo [] internal _token;
 
+    IRegistry internal _registry;
     ReleaseManager internal _releaseManager;
     IERC20Metadata internal _dipToken;
 
@@ -53,62 +60,23 @@ contract TokenRegistry is
         _;
     }
 
-    constructor(
-        address registry,
-        address dipToken
-    )
-    { 
-        initialize(registry, dipToken);
-    }
-
-    function initialize(
-        address registry,
-        address dipToken
-    )
-        public
-        initializer()
+    constructor(IRegistry registry, IERC20Metadata dipToken)
+        AccessManaged(msg.sender)
     {
-        initializeNftOwnable(msg.sender, registry);
-
-        // initialize release manager
-        _releaseManager = ReleaseManager(msg.sender);
-
-        // set dip token
-        _dipToken = IERC20Metadata(dipToken);
+        // set authority
+        address authority = RegistryAdmin(registry.getRegistryAdminAddress()).authority();
+        setAuthority(authority);
+        
+        _registry = registry;
+        _dipToken = dipToken;
 
         // register dip token
         uint256 chainId = block.chainid;
         _registerToken(
             chainId, 
-            dipToken, 
+            address(_dipToken), 
             _dipToken.decimals(), 
             _dipToken.symbol());
-
-        // activation of dip token needs to take place outside of the
-        // token registry constructor call
-    }
-
-
-    /// @dev link token registry ownership to nft owner of registry service and register dip token.
-    function linkToRegistryService() 
-        external
-    {
-        // link token registry ownership to registry service
-        address registryService = getRegistry().getServiceAddress(
-                REGISTRY(), 
-                _releaseManager.getInitialVersion());
-        _linkToNftOwnable(registryService);
-
-        // activate dip for initial gif version
-        // as token registry is created in constructor of release manager
-        // release manager can not yet be called in constructor of token registry
-        uint256 chainId = block.chainid;
-        address dipToken = address(_dipToken);
-        VersionPart majorVersion = _releaseManager.getInitialVersion();
-        bool active = true;
-        _active[chainId][dipToken][majorVersion] = active;
-
-        emit LogTokenRegistryTokenStateSet(chainId, dipToken, majorVersion, active);
     }
 
 
@@ -117,7 +85,7 @@ contract TokenRegistry is
     /// the non optional erc20 view functions.
     function registerToken(address tokenAddress)
         external
-        onlyOwner
+        restricted()
     {
         IERC20Metadata token = _verifyOnchainToken(tokenAddress);
         _registerToken(block.chainid, tokenAddress, token.decimals(), token.symbol());
@@ -133,7 +101,7 @@ contract TokenRegistry is
         string memory symbol
     )
         external
-        onlyOwner
+        restricted()
     {
         if (chainId == block.chainid) {
             revert ErrorTokenRegistryNotRemoteToken(chainId, token);
@@ -152,7 +120,7 @@ contract TokenRegistry is
         bool active
     )
         external
-        onlyOwner
+        restricted()
         onlyRegisteredToken(chainId, token)
     {
         _tokenInfo[chainId][token].active = active;
@@ -171,9 +139,11 @@ contract TokenRegistry is
         VersionPart majorVersion, 
         bool active
     )
-        public
+        external
+        restricted()
+        onlyRegisteredToken(chainId, token)
     {
-        setActiveWithVersionCheck(chainId, token, majorVersion, active, true);
+        _setActiveWithVersionCheck(chainId, token, majorVersion, active, true);
     }
 
 
@@ -187,14 +157,27 @@ contract TokenRegistry is
         bool active,
         bool enforceVersionCheck
     )
-        public
-        onlyOwner
+        external
+        restricted()
         onlyRegisteredToken(chainId, token)
+    {
+        _setActiveWithVersionCheck(chainId, token, majorVersion, active, enforceVersionCheck);
+    }
+
+
+    function _setActiveWithVersionCheck(
+        uint256 chainId, 
+        address token, 
+        VersionPart majorVersion, 
+        bool active,
+        bool enforceVersionCheck
+    )
+        internal
     {
         // verify valid major version
         if(enforceVersionCheck) {
             uint256 version = majorVersion.toInt();
-            if (!getRegistry().isValidRelease(majorVersion)) {
+            if (!getRegistry().isActiveRelease(majorVersion)) {
                 revert ErrorTokenRegistryMajorVersionInvalid(majorVersion);
             }
         }
@@ -238,6 +221,19 @@ contract TokenRegistry is
         return _active[chainId][token][majorVersion];
     }
 
+    function getDipTokenAddress() external view returns (address) {
+        return address(_dipToken);
+    }
+
+    //--- IRegistryLinked --------------------------------------------------//
+
+    /// @dev returns the dip token for this chain
+    function getRegistry() public view returns (IRegistry) {
+        return _registry;
+    }
+
+    //--- internal functions ------------------------------------------------//
+
 
     /// @dev checks if provided token address refers to a smart contract that implements 
     /// erc20 functionality (via its non-optional functions)