@etherisc/gif-next 0.0.2-fd4931b-974 → 0.0.2-fd4ee14-428

package/contracts/shared/Component.sol

@@ -6,21 +6,14 @@ import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessMana
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
 import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 
+import {Amount} from "../type/Amount.sol";
 import {IComponent} from "./IComponent.sol";
 import {IComponents} from "../instance/module/IComponents.sol";
-import {IInstanceService} from "../instance/IInstanceService.sol";
-import {IInstance} from "../instance/IInstance.sol";
-import {InstanceAccessManager} from "../instance/InstanceAccessManager.sol";
-import {InstanceReader} from "../instance/InstanceReader.sol";
-import {IRegistry} from "../registry/IRegistry.sol";
 import {NftId, NftIdLib} from "../type/NftId.sol";
-import {ObjectType, INSTANCE, PRODUCT} from "../type/ObjectType.sol";
-import {VersionPart} from "../type/Version.sol";
+import {ObjectType} from "../type/ObjectType.sol";
 import {Registerable} from "../shared/Registerable.sol";
-import {RoleId, RoleIdLib} from "../type/RoleId.sol";
-import {IAccess} from "../instance/module/IAccess.sol";
 import {TokenHandler} from "../shared/TokenHandler.sol";
-import {VersionPart} from "../type/Version.sol";
+import {VersionPartLib} from "../type/Version.sol";
 
 abstract contract Component is
     AccessManagedUpgradeable,
@@ -95,7 +88,7 @@ abstract contract Component is
     }
 
 
-    function approveTokenHandler(uint256 spendingLimitAmount)
+    function approveTokenHandler(Amount spendingLimitAmount)
         external
         virtual
         onlyOwner
@@ -103,7 +96,7 @@ abstract contract Component is
         approveTokenHandler(address(getToken()), spendingLimitAmount);
     }
 
-    function approveTokenHandler(address token, uint256 spendingLimitAmount)
+    function approveTokenHandler(address token, Amount spendingLimitAmount)
         public
         virtual
         onlyOwner
@@ -114,7 +107,7 @@ abstract contract Component is
 
         IERC20Metadata(token).approve(
             address(getTokenHandler()),
-            spendingLimitAmount);
+            spendingLimitAmount.toInt());
 
         emit LogComponentTokenHandlerApproved(address(getTokenHandler()), spendingLimitAmount);
     }
@@ -259,6 +252,7 @@ abstract contract Component is
 
     }
 
+
     /// @dev for component contracts that hold its own component information 
     /// this function creates and sets a token hanlder for the components tokens
     function _createAndSetTokenHandler()
@@ -268,6 +262,7 @@ abstract contract Component is
         $._tokenHandler = new TokenHandler(address($._token));
     }
 
+
     /// @dev depending on the source of the component information this function needs to be overwritten. 
     /// eg for instance linked components that externally store this information with the instance store contract
     function _getComponentInfo() internal virtual view returns (IComponents.ComponentInfo memory info) {

package/contracts/shared/ComponentService.sol

@@ -10,8 +10,8 @@ import {IRegistryService} from "../registry/IRegistryService.sol";
 import {IInstance} from "../instance/IInstance.sol";
 import {IAccess} from "../instance/module/IAccess.sol";
 import {NftId} from "../type/NftId.sol";
-import {ObjectType, REGISTRY, COMPONENT, DISTRIBUTION, INSTANCE, POOL, PRODUCT} from "../type/ObjectType.sol";
-import {RoleId, DISTRIBUTION_OWNER_ROLE, POOL_OWNER_ROLE, PRODUCT_OWNER_ROLE, POLICY_SERVICE_ROLE, PRODUCT_SERVICE_ROLE} from "../type/RoleId.sol";
+import {ObjectType, REGISTRY, COMPONENT, DISTRIBUTION, INSTANCE, ORACLE, POOL, PRODUCT} from "../type/ObjectType.sol";
+import {RoleId, DISTRIBUTION_OWNER_ROLE, ORACLE_OWNER_ROLE, POOL_OWNER_ROLE, PRODUCT_OWNER_ROLE, POLICY_SERVICE_ROLE, PRODUCT_SERVICE_ROLE} from "../type/RoleId.sol";
 import {KEEP_STATE} from "../type/StateId.sol";
 import {IComponents} from "../instance/module/IComponents.sol";
 import {IComponentService} from "./IComponentService.sol";
@@ -64,11 +64,6 @@ contract ComponentService is
         registerInterface(type(IComponentService).interfaceId);
     }
 
-
-    function getDomain() public pure virtual override returns(ObjectType) {
-        return COMPONENT();
-    }
-
     //-------- component ----------------------------------------------------//
 
     function setWallet(address newWallet) external virtual {
@@ -280,9 +275,31 @@ contract ComponentService is
         _changeTargetBalance(DECREASE, instanceStore, distributionNftId, amount, feeAmount);
     }
 
+    //-------- oracle -------------------------------------------------------//
+
+    function registerOracle()
+        external
+        virtual
+    {
+        address contractAddress = msg.sender;
+        RoleId[] memory roles = new RoleId[](0);
+        bytes4[][] memory selectors = new bytes4[][](0);
+
+        // register/create component setup
+        (
+            , // instance reader
+            InstanceStore instanceStore, 
+            NftId componentNftId
+        ) = _register(
+            contractAddress,
+            ORACLE(),
+            ORACLE_OWNER_ROLE(),
+            roles,
+            selectors);            
+    }
+
     //-------- pool ---------------------------------------------------------//
 
-    /// @dev registers the sending component as a distribution component
     function registerPool()
         external
         virtual
@@ -291,7 +308,7 @@ contract ComponentService is
         RoleId[] memory roles = new RoleId[](2);
         bytes4[][] memory selectors = new bytes4[][](2);
 
-        // authorizaion for distribution owner
+        // authorizaion for pool owner
         roles[0] = POOL_OWNER_ROLE();
         selectors[0] = _createSelectors(IPoolComponent.setFees.selector);
 
@@ -526,7 +543,7 @@ contract ComponentService is
     }
 
 
-    function _createSelectors(bytes4 selector) internal view returns (bytes4[] memory selectors) {
+    function _createSelectors(bytes4 selector) internal pure returns (bytes4[] memory selectors) {
         selectors = new bytes4[](1);
         selectors[0] = selector;
     }
@@ -560,18 +577,13 @@ contract ComponentService is
         RoleId requiredRole
     )
         internal
-        // view
+        view
         returns (
             IInstance instance,
             IInstanceLinkedComponent component,
             address owner
         )
     {
-        // check component has not already been registered
-        if (getRegistry().getNftId(componentAddress).gtz()) {
-            revert ErrorComponentServiceAlreadyRegistered(componentAddress);
-        }
-
         // check this is a component
         component = IInstanceLinkedComponent(componentAddress);
         if(!component.supportsInterface(type(IInstanceLinkedComponent).interfaceId)) {
@@ -584,12 +596,22 @@ contract ComponentService is
             revert ErrorComponentServiceInvalidType(componentAddress, requiredType, info.objectType);
         }
 
+        // check component has not already been registered
+        if (getRegistry().getNftId(componentAddress).gtz()) {
+            revert ErrorComponentServiceAlreadyRegistered(componentAddress);
+        }
+
         // check instance has assigned required role to inital owner
         instance = _getInstance(info.parentNftId);
         owner = info.initialOwner;
 
-        if(!instance.getInstanceAccessManager().hasRole(requiredRole, owner)) {
+        (bool hasRole,) = instance.getInstanceAccessManager().hasRole(requiredRole.toInt(), owner);
+        if(!hasRole) {
             revert ErrorComponentServiceExpectedRoleMissing(info.parentNftId, requiredRole, owner);
         }
     }
+
+    function _getDomain() internal pure virtual override returns(ObjectType) {
+        return COMPONENT();
+    }
 }

package/contracts/shared/ComponentVerifyingService.sol

@@ -33,12 +33,10 @@ abstract contract ComponentVerifyingService is
         )
     {
         componentNftId = getRegistry().getNftId(msg.sender);
-        (componentInfo, instance) = _getAndVerifyComponentInfo(componentNftId, expectedType);
-
-        // ensure component is not locked
-        if (instance.getInstanceAccessManager().isTargetLocked(componentInfo.objectAddress)) {
-            revert ErrorComponentVerifyingServiceComponentIsLocked(componentNftId);
-        }
+        (componentInfo, instance) = _getAndVerifyComponentInfo(
+            componentNftId, 
+            expectedType,
+            true); // only active
     }
 
 
@@ -48,7 +46,8 @@ abstract contract ComponentVerifyingService is
     /// - the component has the wrong object type
     function _getAndVerifyComponentInfo(
         NftId componentNftId,
-        ObjectType expectedType // assume always of `component` type
+        ObjectType expectedType, // assume always of `component` type
+        bool onlyActive
     )
         internal
         virtual
@@ -85,6 +84,13 @@ abstract contract ComponentVerifyingService is
         }
 
         instance = _getInstance(info.parentNftId);
+
+        // ensure component is not locked
+        if (onlyActive) {
+            if (instance.getInstanceAccessManager().isTargetClosed(info.objectAddress)) {
+                revert ErrorComponentVerifyingServiceComponentIsLocked(componentNftId);
+            }
+        }
     }
 
 

package/contracts/shared/ERC165.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
-pragma solidity ^0.8.19;
+pragma solidity ^0.8.20;
 
 import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol"; 

package/contracts/shared/IAccessAdmin.sol

@@ -0,0 +1,168 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
+
+import {RoleId} from "../type/RoleId.sol";
+import {Selector} from "../type/Selector.sol";
+import {Str} from "../type/String.sol";
+import {Timestamp} from "../type/Timestamp.sol";
+
+interface IAccessAdmin is 
+    IAccessManaged
+{
+
+    // roles
+    event LogRoleCreated(RoleId roleId, RoleId roleAdminId, string name);
+    event LogRoleDisabled(RoleId roleId, bool disabled, Timestamp disabledAtOld);
+    event LogTargetCreated(address target, string name);
+    event LogFunctionCreated(address target, Selector selector, string name);
+
+    // only deployer modifier
+    error ErrorNotDeployer();
+
+    // only role admin modifier
+    error ErrorNotAdminOfRole(RoleId adminRoleId);
+
+    // only role owner modifier
+    error ErrorNotRoleOwner(RoleId roleId);
+
+    // initialize authority
+    error ErrorAuthorityAlreadySet();
+    error ErrorAdminRoleMissing();
+
+    // create role
+    error ErrorRoleAlreadyCreated(RoleId roleId, string name);
+    error ErrorRoleAdminNotExisting(RoleId adminRoleId);
+    error ErrorRoleNameEmpty(RoleId roleId);
+    error ErrorRoleNameAlreadyExists(RoleId roleId, string name, RoleId existingRoleId);
+
+    // grant/revoke/renounce role
+    error ErrorRoleUnknown(RoleId roleId);
+    error ErrorRoleIsLocked(RoleId roleId);
+    error ErrorRoleIsDisabled(RoleId roleId);
+    error ErrorRoleMembersLimitReached(RoleId roleId, uint256 memberCountLimit);
+    error ErrorRoleRemovalDisabled(RoleId roleId);
+
+    // create target
+    error ErrorTargetAlreadyCreated(address target, string name);
+    error ErrorTargetNameEmpty(address target);
+    error ErrorTargetNameAlreadyExists(address target, string name, address existingTarget);
+    error ErrorTargetNotAccessManaged(address target);
+    error ErrorTargetAuthorityMismatch(address expectedAuthority, address actualAuthority);
+
+    // lock target
+    error ErrorTagetNotLockable();
+
+    // authorize target functions
+    error ErrorAuthorizeForAdminRoleInvalid(address target);
+
+    // check target
+    error ErrorTargetUnknown(address target);
+
+    struct RoleInfo {
+        RoleId adminRoleId;
+        Str name;
+        uint256 maxMemberCount;
+        bool memberRemovalDisabled;
+        Timestamp disabledAt;
+        bool exists;
+    }
+
+    struct RoleNameInfo {
+        RoleId roleId;
+        bool exists;
+    }
+
+    struct TargetInfo {
+        Str name;
+        Timestamp createdAt;
+    }
+
+    struct Function {
+        Selector selector; // function selector
+        Str name; // function name
+    }
+
+    /// @dev Create a new named role using the specified parameters.
+    /// The adminRoleId refers to the required role to grant/revoke the newly created role.
+    /// permissioned: the caller must have the manager role (getManagerRole).
+    function createRole(
+        RoleId roleId, 
+        RoleId adminRoleId, 
+        string memory name,
+        uint256 maxMemberCount,
+        bool memberRemovalDisabled
+    )
+        external;
+
+    /// @dev Set the disabled status of the speicified role.
+    /// Role disabling only prevents the role from being granted to new accounts.
+    /// Existing role members may still execute functions that are authorized for that role.
+    /// Permissioned: the caller must have the manager role (getManagerRole).
+    function setRoleDisabled(RoleId roleId, bool disabled) external;
+
+    /// @dev Grant the specified account the provided role.
+    /// Permissioned: the caller must have the roles admin role.
+    function grantRole(address account, RoleId roleId) external;
+
+    /// @dev Revoke the provided role from the specified account.
+    /// Permissioned: the caller must have the roles admin role.
+    function revokeRole(address account, RoleId roleId) external;
+
+    /// @dev Removes the provided role from the caller
+    function renounceRole(RoleId roleId) external;
+
+    /// @dev Create a new named target.
+    /// Permissioned: the caller must have the manager role (getManagerRole).
+    function createTarget(address target, string memory name) external;
+
+    /// @dev Set the locked status of the speicified contract.
+    /// IMPORTANT: using this function the AccessManager might itself be put into locked state from which it cannot be unlocked again.
+    /// Overwrite this function if a different use case specific behaviour is required.
+    /// Alternatively, add specific function to just unlock this contract without a restricted() modifier.
+    /// Permissioned: the caller must have the manager role (getManagerRole).
+    function setTargetLocked(address target, bool locked) external;
+
+    /// @dev Specifies which functions of the target can be accessed by the provided role.
+    /// Previously existing authorizations will be overwritten.
+    /// Authorizing the admin role is not allowed, use function unauthorizedFunctions for this.
+    /// Permissioned: the caller must have the manager role (getManagerRole).
+    function authorizeFunctions(address target, RoleId roleId, Function[] memory functions) external;
+
+    /// @dev Specifies for which functionss to remove any previous authorization
+    /// Permissioned: the caller must have the manager role (getManagerRole).
+    function unauthorizeFunctions(address target, Function[] memory functions) external;
+
+    //--- view functions ----------------------------------------------------//
+
+    function roles() external view returns (uint256 numberOfRoles);
+    function getRoleId(uint256 idx) external view returns (RoleId roleId);
+    function getAdminRole() external view returns (RoleId roleId);
+    function getManagerRole() external view returns (RoleId roleId);
+    function getPublicRole() external view returns (RoleId roleId);
+
+    function roleExists(RoleId roleId) external view returns (bool exists); 
+    function isRoleDisabled(RoleId roleId) external view returns (bool roleIsActive);
+    function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory roleInfo);
+    function getRoleForName(Str name) external view returns (RoleNameInfo memory);
+
+    function hasRole(address account, RoleId roleId) external view returns (bool);
+    function roleMembers(RoleId roleId) external view returns (uint256 numberOfMembers);
+    function getRoleMember(RoleId roleId, uint256 idx) external view returns (address account);
+
+    function targetExists(address target) external view returns (bool exists);
+    function isTargetLocked(address target) external view returns (bool locked);
+    function targets() external view returns (uint256 numberOfTargets);
+    function getTargetAddress(uint256 idx) external view returns (address target);
+    function getTargetInfo(address target) external view returns (TargetInfo memory targetInfo);
+    function getTargetForName(Str name) external view returns (address target);
+
+    function authorizedFunctions(address target) external view returns (uint256 numberOfFunctions);
+    function getAuthorizedFunction(address target, uint256 idx) external view returns (Function memory func, RoleId roleId);
+    function canCall(address caller, address target, Selector selector) external view returns (bool can);
+
+    function toFunction(bytes4 selector, string memory name) external pure returns (Function memory);
+    function isAccessManaged(address target) external view returns (bool);
+    function deployer() external view returns (address);
+}

package/contracts/shared/IAccessManagerExtended.sol

@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Contracts (last updated v5.0.0) (access/manager/IAccessManager.sol)
+
+pragma solidity ^0.8.20;
+
+import {IAccessManager} from "@openzeppelin/contracts/access/manager/IAccessManager.sol";
+
+import {Timestamp} from "../type/Timestamp.sol";
+
+interface IAccessManagerExtended is IAccessManager {
+    // Structure that stores the details for a target contract.
+    struct TargetInfo {
+        address taddress;
+        //IAccess.Type ttype;
+        string name;
+        Timestamp createdAt;
+        //Timestamp updatedAt;
+    }
+
+    // Structure that stores the details of a role.
+    struct RoleInfo {
+        uint64 id;
+        //IAccess.Type rtype;
+        string name;
+        Timestamp createdAt;
+    }
+
+    event LogRoleCreation(uint64 roleId, string name);// IAccess.Type rtype);
+    event LogTargetCreation(address target, string name);// IAccess.Type ttype);
+
+    error AccessManagerRoleIdNotExists(uint64 roleId);
+    error AccessManagerRoleIdAlreadyExists(uint64 roleId);
+    error AccessManagerRoleNameAlreadyExists(uint64 newRoleId, uint64 existingRoleId, string duplicateName);
+    error AccessManagerRoleIdZero();
+    error AccessManagerRoleNameEmpty(uint64 roleId);
+    error AccessManagerRoleIdTooBig(uint64 roleId);
+
+    error AccessManagerTargetAlreadyExists(address target);
+    error AccessManagerTargetNotExists(address target);
+    error AccessManagerTargetNameAlreadyExists(address newTarget, address existingTarget, string duplicateName);
+    error AccessManagerTargetAddressZero();
+    error AccessManagerTargetNameEmpty(address target);
+    error AccessManagerTargetAuthorityInvalid(address target, address targetAuthority);
+
+    function getRoleMembers(uint64 roleId) external view returns (uint256 numberOfMembers);
+
+    function getRoleMember(uint64 roleId, uint256 idx) external view returns (address member);
+
+    function getRoleId(uint256 idx) external view returns (uint64 roleId);
+
+    // TODO returns ADMIN_ROLE id for non existent name
+    function getRoleId(string memory name) external view returns (uint64 roleId);
+
+    function getRoles() external view returns (uint256 numberOfRoles);
+
+    function isRoleExists(uint64 roleId) external view returns (bool exists);
+
+    function getRoleInfo(uint64 roleId) external view returns (RoleInfo memory);
+
+    function isRoleNameExists(string memory name) external view returns (bool);
+
+    function isTargetExists(address target) external view returns (bool);
+
+    function isTargetNameExists(string memory name) external view returns (bool);
+    
+    function getTargetAddress(string memory name) external view returns(address targetAddress);
+
+    function getTargetInfo(address target) external view returns (TargetInfo memory);
+
+
+    function createRole(uint64 roleId, string memory roleName/*, IAccess.Type rtype*/) external;
+
+    function createTarget(address target, string memory name/*, IAccess.Type.Custom*/) external;
+}

package/contracts/shared/IAccessManagerExtendedWithDisable.sol

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity ^0.8.20;
+
+import {IAccessManagerExtended} from "./IAccessManagerExtended.sol";
+
+import {Timestamp} from "../type/Timestamp.sol";
+import {VersionPart} from "../type/Version.sol";
+import {Seconds} from "../type/Seconds.sol";
+
+interface IAccessManagerExtendedWithDisable is IAccessManagerExtended {
+
+    error AccessManagerDisabled();
+
+    function disable(Seconds delay) external;
+    function enable() external;
+    function getVersion() external view returns (VersionPart version);
+}

package/contracts/shared/IComponent.sol

@@ -4,14 +4,10 @@ pragma solidity ^0.8.20;
 import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
 
+import {Amount} from "../type/Amount.sol";
 import {IComponents} from "../instance/module/IComponents.sol";
-import {IInstance} from "../instance/IInstance.sol";
-import {IInstanceService} from "../instance/IInstanceService.sol";
-import {IProductService} from "../product/IProductService.sol";
 import {IRegisterable} from "../shared/IRegisterable.sol";
 import {ITransferInterceptor} from "../registry/ITransferInterceptor.sol";
-import {NftId} from "../type/NftId.sol";
-import {ObjectType} from "../type/ObjectType.sol";
 import {TokenHandler} from "../shared/TokenHandler.sol";
 
 /// @dev component base class
@@ -32,12 +28,12 @@ interface IComponent is
 
     event LogComponentWalletAddressChanged(address oldWallet, address newWallet);
     event LogComponentWalletTokensTransferred(address from, address to, uint256 amount);
-    event LogComponentTokenHandlerApproved(address token, uint256 limit);
+    event LogComponentTokenHandlerApproved(address token, Amount limit);
 
     /// @dev approves token hanlder to spend up to the specified amount of tokens
     /// reverts if component wallet is not component itself
     /// only component owner (nft holder) is authorizes to call this function
-    function approveTokenHandler(uint256 spendingLimitAmount) external;
+    function approveTokenHandler(Amount spendingLimitAmount) external;
 
     /// @dev sets the wallet address for the component
     /// if the current wallet has tokens, these will be transferred

package/contracts/shared/IComponentService.sol

@@ -52,6 +52,8 @@ interface IComponentService is
     function unlock() external;
 
     //-------- product ------------------------------------------------------//
+
+    /// @dev registers the sending component as a product component
     function registerProduct() external;
 
     function setProductFees(
@@ -63,6 +65,8 @@ interface IComponentService is
     function decreaseProductFees(InstanceStore instanceStore, NftId productNftId, Amount feeAmount) external;
 
     //-------- distribution -------------------------------------------------//
+
+    /// @dev registers the sending component as a distribution component
     function registerDistribution() external;
 
     function setDistributionFees(
@@ -73,7 +77,14 @@ interface IComponentService is
     function increaseDistributionBalance(InstanceStore instanceStore, NftId distributionNftId, Amount amount, Amount feeAmount) external;
     function decreaseDistributionBalance(InstanceStore instanceStore, NftId distributionNftId, Amount amount, Amount feeAmount) external;
 
+    //-------- oracle -------------------------------------------------------//
+
+    /// @dev registers the sending component as an oracle component
+    function registerOracle() external;
+
     //-------- pool ---------------------------------------------------------//
+
+    /// @dev registers the sending component as a pool component
     function registerPool() external;
 
     function setPoolFees(

package/contracts/shared/IKeyValueStore.sol

@@ -32,7 +32,7 @@ interface IKeyValueStore is ILifecycle {
         // eg account outside gif objects that initiated the tx
         // implies the caller needs to be propagated through all calls up to key values store itself
         // to always have the instance address there doesn't seem to make sense
-        address updatedBy;
+        // address updatedBy;
         Blocknumber updatedIn;
         Blocknumber createdIn;
     }

package/contracts/shared/INftOwnable.sol

@@ -16,7 +16,7 @@ interface INftOwnable is
     error ErrorNftOwnableAlreadyLinked(NftId nftId);
     error ErrorNftOwnableContractNotRegistered(address contractAddress);
 
-    function linkToRegisteredNftId() external;
+    function linkToRegisteredNftId() external returns (NftId);
 
     function getNftId() external view returns (NftId);
     function getOwner() external view returns (address);

package/contracts/shared/IService.sol

@@ -1,11 +1,12 @@
 // SPDX-License-Identifier: Apache-2.0
-pragma solidity ^0.8.19;
+pragma solidity ^0.8.20;
 
 import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
 
 import {IRegisterable} from "./IRegisterable.sol";
 import {IVersionable} from "./IVersionable.sol";
 import {ObjectType} from "../type/ObjectType.sol";
+import {RoleId} from "../type/RoleId.sol";
 
 interface IService is 
     IRegisterable,
@@ -14,5 +15,11 @@ interface IService is
 {
     error ErrorServiceNotImplemented();
 
+    /// @dev returns the domain for this service.
+    /// In any GIF release only one service for any given domain may be deployed.
     function getDomain() external pure returns(ObjectType serviceDomain);
+
+    /// @dev returns the GIF release specific role id.
+    /// These role ids are used to authorize service to service communication.
+    function getRoleId() external pure returns(RoleId serviceRoleId);
 }