@etherisc/gif-next 0.0.2-ff1bf36-818 → 0.0.2-ff795d8-141

package/contracts/authorization/IAuthorization.sol

@@ -1,54 +1,27 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {IAccess} from "../authorization/IAccess.sol";
-import {ObjectType} from "../type/ObjectType.sol";
+import {IServiceAuthorization} from "./IServiceAuthorization.sol";
 import {RoleId} from "../type/RoleId.sol";
 import {Str} from "../type/String.sol";
-import {VersionPart} from "../type/Version.sol";
+
 
 interface IAuthorization is 
-     IAccess 
+     IServiceAuthorization
 {
 
-     /// @dev Returns the release (VersionPart) for which the authorizations are defined by this contract.
-     /// Matches with the release returned by the linked service authorization.
-     function getRelease() external view returns(VersionPart release);
-
-     /// @dev Returns the list of involved roles.
-     function getRoles() external view returns(RoleId[] memory roles);
-
-     /// @dev Returns the service role for the specified service domain.
-     function getServiceRole(ObjectType serviceDomain) external pure returns (RoleId serviceRoleId);
-
-     /// @dev Returns the name for the provided role id.
-     function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory roleInfo);
-
-     /// @dev Returns true iff the specified role id exists.
-     function roleExists(RoleId roleId) external view returns(bool exists);
+     /// @dev Returns the token hander name.
+     /// Only components have a token handler.
+     function getTokenHandlerName() external view returns(string memory name);
 
-     /// @dev Returns the main target id name as string.
-     /// This name is used to derive the target id and a corresponding target role name
-     /// Overwrite this function to change the basic pool target name.
-     function getTargetName() external view returns (string memory name);
-
-     /// @dev Returns the main target.
-     function getTarget() external view returns(Str target);
+     /// @dev Returns the token hander target.
+     /// Only components have a token handler.
+     function getTokenHandlerTarget() external view returns(Str target);
 
      /// @dev Returns the complete list of targets.
      function getTargets() external view returns(Str[] memory targets);
 
      /// @dev Returns true iff the specified target exists.
      function targetExists(Str target) external view returns(bool exists);
-
-     /// @dev Returns the role id associated with the target.
-     /// If no role is associated with the target the zero role id is returned.
-     function getTargetRole(Str target) external view returns(RoleId roleId);
-
-     /// @dev For the given target the list of authorized role ids is returned
-     function getAuthorizedRoles(Str target) external view returns(RoleId[] memory roleIds);
-
-     /// @dev For the given target and role id the list of authorized functions is returned
-     function getAuthorizedFunctions(Str target, RoleId roleId) external view returns(FunctionInfo[] memory authorizatedFunctions);
 }
 

package/contracts/authorization/IServiceAuthorization.sol

@@ -1,38 +1,78 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
 import {IAccess} from "../authorization/IAccess.sol";
 import {ObjectType} from "../type/ObjectType.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {Str} from "../type/String.sol";
 import {VersionPart} from "../type/Version.sol";
 
-interface IServiceAuthorization {
+interface IServiceAuthorization is 
+     IERC165, 
+     IAccess
+{
 
-     /// @dev Returns the commit hash representing the deployed release
-     function getCommitHash()
-          external
-          view
-          returns(string memory commitHash);
+     error ErrorAuthorizationMainTargetNameEmpty();
+     error ErrorAuthorizationTargetDomainZero();
+     error ErrorAuthorizationReleaseInvalid(uint8 release);
+     error ErrorAuthorizationCommitHashInvalid(string commitHash);
 
-     /// @dev Returns the release (VersionPart) for which the service authorizations are defined by this contract.
-     function getRelease()
-          external
-          view
-          returns(VersionPart release);
+     /// @dev Returns the main domain of the authorization.
+     function getDomain() external view returns(ObjectType targetDomain);
 
-     /// @dev Returns the service domain for the provided index.
-     function getServiceDomain(uint idx) external view returns(ObjectType serviceDomain);
+     /// @dev Returns the release (VersionPart) for which the authorizations are defined by this contract.
+     /// Matches with the release returned by the linked service authorization.
+     function getRelease() external view returns(VersionPart release);
+
+     /// @dev Returns the commit hash for the related GIF release.
+     function getCommitHash() external view returns(string memory commitHash);
+
+     /// @dev Returns the main target id name as string.
+     /// This name is used to derive the target id and a corresponding target role name
+     /// Overwrite this function to change the basic pool target name.
+     function getMainTargetName() external view returns (string memory name);
+
+     /// @dev Returns the main target.
+     function getMainTarget() external view returns(Str target);
 
      /// @dev Returns the full list of service domains for this release.
      /// Services need to be registered for the release in revers order of this list.
      function getServiceDomains() external view returns(ObjectType[] memory serviceDomains);
 
+     /// @dev Returns the service domain for the provided index.
+     function getServiceDomain(uint256 idx) external view returns(ObjectType serviceDomain);
+
+     /// @dev Returns the service target for the specified domain.
+     function getServiceTarget(ObjectType serviceDomain) external view returns(Str serviceTarget);
+
+     /// @dev Returns the service target for the specified domain.
+     function getServiceRole(ObjectType serviceDomain) external view returns(RoleId serviceRoleId);
+
      /// @dev Returns the expected service address for the provided domain.
      function getServiceAddress(ObjectType serviceDomain) external view returns(address service);
 
-     /// @dev Given the service domain this function returns the list of other service domains that are authorized to access this service.
-     function getAuthorizedDomains(ObjectType serviceDomain) external view returns(ObjectType[] memory authorizatedDomains);
+     /// @dev Returns the role id associated with the target.
+     /// If no role is associated with the target the zero role id is returned.
+     function getTargetRole(Str target) external view returns(RoleId roleId);
+
+     /// @dev Returns true iff the role exists.
+     function roleExists(RoleId roleId) external view returns(bool exists);
+
+     /// @dev Returns the list of involved roles.
+     function getRoles() external view returns(RoleId[] memory roles);
+
+     /// @dev Returns the role info for the provided role id.
+     function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory roleInfo);
+
+     /// @dev Returns the name for the provided role id.
+     function getRoleName(RoleId roleId) external view returns (string memory roleName);
+
+     /// @dev For the given target the list of authorized role ids is returned
+     function getAuthorizedRoles(Str target) external view returns(RoleId[] memory roleIds);
 
-     /// @dev For the given service domain and authorized domain the function returns the list of authorized functions
-     function getAuthorizedFunctions(ObjectType serviceDomain, ObjectType authorizedDomain) external view returns(IAccess.FunctionInfo[] memory authorizatedFunctions);
+     /// @dev For the given target and role id the list of authorized functions is returned
+     function getAuthorizedFunctions(Str target, RoleId roleId) external view returns(FunctionInfo[] memory authorizatedFunctions);
 }
 

package/contracts/authorization/ServiceAuthorization.sol

@@ -2,82 +2,313 @@
 pragma solidity ^0.8.20;
 
 import {IAccess} from "../authorization/IAccess.sol";
-import {ObjectType} from "../type/ObjectType.sol";
 import {IServiceAuthorization} from "./IServiceAuthorization.sol";
+
+import {ADMIN_ROLE_NAME, PUBLIC_ROLE_NAME} from "./AccessAdmin.sol";
+import {InitializableERC165} from "../shared/InitializableERC165.sol";
+import {ObjectType, ObjectTypeLib, ALL} from "../type/ObjectType.sol";
+import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
 import {SelectorLib} from "../type/Selector.sol";
-import {StrLib} from "../type/String.sol";
+import {Str, StrLib} from "../type/String.sol";
 import {TimestampLib} from "../type/Timestamp.sol";
 import {VersionPart, VersionPartLib} from "../type/Version.sol";
 
-/// @dev Base contract for release specific service authorization contracts.
-contract ServiceAuthorization
-     is IServiceAuthorization
+
+/// @dev Base contract for release specific service authorization contracts and for Authorization contracts.
+contract ServiceAuthorization is 
+     InitializableERC165,
+     IServiceAuthorization
 {
-     uint256 public constant GIF_VERSION_3 = 3;
 
-     string private _commitHash;
+     string public constant COMMIT_HASH = "1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a";
+
+     uint256 public constant COMMIT_HASH_LENGTH = 40;
+     uint256 public constant GIF_INITIAL_VERSION = 3;
+
+     string public constant SERVICE_NAME_SUFFIX = "Service";
+     string public constant ROLE_NAME_SUFFIX = "_Role";
+
+     ObjectType public immutable DOMAIN;
+     uint256 internal immutable _release;
+     string internal _commitHash;
 
+     string internal _mainTargetName;
+     Str internal _mainTarget;
+
+     // services
      ObjectType[] internal _serviceDomains;
      mapping(ObjectType domain => address service) internal _serviceAddress;
-     mapping(ObjectType domain => ObjectType[] authorizedDomains) internal _authorizedDomains;
-     mapping(ObjectType domain => mapping(ObjectType authorizedDomain => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
 
-     constructor(string memory commitHash) {
+     // roles
+     RoleId[] internal _roles;
+     mapping(RoleId role => RoleInfo info) internal _roleInfo;
+
+     // targets
+     Str[] internal _targets;
+     mapping(Str target => bool exists) internal _targetExists;
+     mapping(Str target => RoleId roleId) internal _targetRole;
+     mapping(Str target => RoleId[] authorizedRoles) internal _authorizedRoles;
+     mapping(Str target => mapping(RoleId authorizedRole => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
+
+
+     constructor(
+          string memory mainTargetName, 
+          ObjectType domain,
+          uint8 release,
+          string memory commitHash
+     )
+     {
+          // checks
+          if (bytes(mainTargetName).length == 0) {
+               revert ErrorAuthorizationMainTargetNameEmpty();
+          }
+
+          if (domain == ObjectTypeLib.zero()) {
+               revert ErrorAuthorizationTargetDomainZero();
+          }
+
+          if (release < VersionPartLib.releaseMin().toInt() || release >= VersionPartLib.releaseMax().toInt()) {
+               revert ErrorAuthorizationReleaseInvalid(release);
+          }
+
+          if (bytes(commitHash).length != COMMIT_HASH_LENGTH) {
+               revert ErrorAuthorizationCommitHashInvalid(commitHash);
+          }
+
+          // effects
+          _initializeERC165();
+          _registerInterfaceNotInitializing(type(IServiceAuthorization).interfaceId);
+
+          _mainTargetName = mainTargetName;
+          _mainTarget = StrLib.toStr(mainTargetName);
+
+          DOMAIN = domain;
+          _release = release;
           _commitHash = commitHash;
+
+          // setup of roles defined in OpenZeppelin AccessManager
+          _addRole(ADMIN_ROLE(), _toRoleInfo(ADMIN_ROLE(), RoleType.Core, 1, ADMIN_ROLE_NAME()));
+          _addRole(PUBLIC_ROLE(), _toRoleInfo(ADMIN_ROLE(), RoleType.Core, 1, PUBLIC_ROLE_NAME()));
+
+          // defines service domains relevant for the authorization
           _setupDomains();
           _setupDomainAuthorizations();
      }
 
+     /// @inheritdoc IServiceAuthorization
+     function getDomain() public view returns(ObjectType targetDomain) {
+          return DOMAIN;
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getRelease() public view returns(VersionPart release) {
+          return VersionPartLib.toVersionPart(_release);
+     }
+
+     /// @inheritdoc IServiceAuthorization
      function getCommitHash() external view returns(string memory commitHash) {
           return _commitHash;
      }
 
-     function getRelease() external view returns(VersionPart release) {
-          return VersionPartLib.toVersionPart(GIF_VERSION_3);
+     /// @inheritdoc IServiceAuthorization
+     function getMainTargetName() public view returns (string memory name) {
+          return _mainTargetName;
      }
 
+     /// @inheritdoc IServiceAuthorization
+     function getMainTarget() external view returns(Str target) {
+          return _mainTarget;
+     }
+
+     /// @inheritdoc IServiceAuthorization
      function getServiceDomains() external view returns(ObjectType[] memory serviceDomains) {
           return _serviceDomains;
      }
 
-     function getServiceDomain(uint idx) external view returns(ObjectType serviceDomain) {
+     /// @inheritdoc IServiceAuthorization
+     function getServiceDomain(uint256 idx) external view returns(ObjectType serviceDomain) {
           return _serviceDomains[idx];
      }
 
+     /// @inheritdoc IServiceAuthorization
+     function getServiceTarget(ObjectType serviceDomain) public view returns(Str target) {
+          string memory serviceTargetName = ObjectTypeLib.toVersionedName(
+               ObjectTypeLib.toName(serviceDomain), 
+               "Service", 
+               getRelease());
+
+          return StrLib.toStr(serviceTargetName);
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getServiceRole(ObjectType serviceDomain) public view returns(RoleId serviceRoleId) {
+          // special case domain ALL
+          if (serviceDomain == ALL()) {
+               return PUBLIC_ROLE();
+          }
+
+          Str target = getServiceTarget(serviceDomain);
+          return getTargetRole(target);
+     }
+
+     /// @inheritdoc IServiceAuthorization
      function getServiceAddress(ObjectType serviceDomain) external view returns(address service) {
           return _serviceAddress[serviceDomain];
      }
 
-     function getAuthorizedDomains(ObjectType serviceDomain) external view returns(ObjectType[] memory authorizatedDomains) {
-          return _authorizedDomains[serviceDomain];
+     /// @inheritdoc IServiceAuthorization
+     function getTargetRole(Str target) public view returns(RoleId roleId) {
+          return _targetRole[target];
      }
 
-     function getAuthorizedFunctions(ObjectType serviceDomain, ObjectType authorizedDomain) external view returns(IAccess.FunctionInfo[] memory authorizatedFunctions) {
-          return _authorizedFunctions[serviceDomain][authorizedDomain];
+     /// @inheritdoc IServiceAuthorization
+     function roleExists(RoleId roleId) public view returns(bool exists) {
+          return _roleInfo[roleId].roleType != RoleType.Undefined;
      }
 
-     /// @dev Overwrite this function for a specific realease.
+     /// @inheritdoc IServiceAuthorization
+     function getRoles() external view returns(RoleId[] memory roles) {
+          return _roles;
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory info) {
+          return _roleInfo[roleId];
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getRoleName(RoleId roleId) external view returns (string memory roleName) {
+          return _roleInfo[roleId].name.toString();
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getAuthorizedRoles(Str target) external view returns(RoleId[] memory roleIds) {
+          return _authorizedRoles[target];
+     }
+
+     /// @inheritdoc IServiceAuthorization
+     function getAuthorizedFunctions(Str target, RoleId roleId) external view returns(FunctionInfo[] memory authorizatedFunctions) {
+          return _authorizedFunctions[target][roleId];
+     }
+
+     /// @dev Defines service domains relevant for the authorization.
+     /// When used for ReleaseAdmin the list defines the services to be registered for the release.
+     /// IMPORTANT: Both the list of the service domains as well as the ordering of the domains is important.
+     /// Trying to register services not in this list or register services in a different order will result in an error.
+     // solhint-disable-next-line no-empty-blocks
      function _setupDomains() internal virtual {}
 
      /// @dev Overwrite this function for a specific realease.
+     // solhint-disable-next-line no-empty-blocks
      function _setupDomainAuthorizations() internal virtual {}
 
      /// @dev Use this method to to add an authorized domain.
      /// The services will need to be registered in the order they are added using this function.
-     function _authorizeDomain(ObjectType serviceDomain, address serviceAddress) internal {
+     function _authorizeServiceDomain(ObjectType serviceDomain, address serviceAddress) internal {
           _serviceDomains.push(serviceDomain);
           _serviceAddress[serviceDomain] = serviceAddress;
+
+          string memory serviceName = ObjectTypeLib.toVersionedName(
+               ObjectTypeLib.toName(serviceDomain), 
+               SERVICE_NAME_SUFFIX, 
+               getRelease());
+
+          _addTargetWithRole(
+               serviceName, 
+               RoleIdLib.toServiceRoleId(serviceDomain, getRelease()), 
+               string(abi.encodePacked(serviceName, ROLE_NAME_SUFFIX)));
+     }
+
+
+     /// @dev Use this method to to add an authorized target together with its target role.
+     function _addTargetWithRole(
+          string memory targetName, 
+          RoleId roleId, 
+          string memory roleName
+     )
+          internal
+     {
+          // add target
+          Str target = StrLib.toStr(targetName);
+          _targets.push(target);
+
+          _targetExists[target] = true;
+
+          // link role to target if defined
+          if (roleId != RoleIdLib.zero()) {
+               // add role if new
+               if (!roleExists(roleId)) {
+                    _addContractRole(roleId, roleName);
+               }
+
+               // link target to role
+               _targetRole[target] = roleId;
+          }
+     }
+
+
+     /// @dev Add a contract role for the provided role id and name.
+     function _addContractRole(RoleId roleId, string memory name) internal {
+          _addRole(
+               roleId,
+               _toRoleInfo(
+                    ADMIN_ROLE(),
+                    RoleType.Contract,
+                    1,
+                    name));
      }
 
+
+     /// @dev Use this method to to add an authorized role.
+     function _addRole(RoleId roleId, RoleInfo memory info) internal {
+          _roles.push(roleId);
+          _roleInfo[roleId] = info;
+     }
+
+
+     /// @dev creates a role info object from the provided parameters
+     function _toRoleInfo(RoleId adminRoleId, RoleType roleType, uint32 maxMemberCount, string memory name) internal view returns (RoleInfo memory info) {
+          return RoleInfo({
+               name: StrLib.toStr(name),
+               adminRoleId: adminRoleId,
+               roleType: roleType,
+               maxMemberCount: maxMemberCount,
+               createdAt: TimestampLib.blockTimestamp(),
+               pausedAt: TimestampLib.max()});
+     }
+
+
      /// @dev Use this method to authorize the specified domain to access the service domain.
-     function _authorizeForService(ObjectType serviceDomain, ObjectType authorizedDomain)
+     function _authorizeForService(
+          ObjectType serviceDomain, 
+          ObjectType authorizedDomain
+     )
+          internal
+          returns (IAccess.FunctionInfo[] storage authorizatedFunctions)
+     {
+          Str serviceTarget = getServiceTarget(serviceDomain);
+          RoleId authorizedRoleId = getServiceRole(authorizedDomain);
+
+          return _authorizeForTarget(serviceTarget.toString(), authorizedRoleId);
+     }
+
+
+     /// @dev Use this method to authorize the specified role to access the target.
+     function _authorizeForTarget(string memory target, RoleId authorizedRoleId)
           internal
           returns (IAccess.FunctionInfo[] storage authorizatedFunctions)
      {
-          _authorizedDomains[serviceDomain].push(authorizedDomain);
-          return _authorizedFunctions[serviceDomain][authorizedDomain];
+          Str targetStr = StrLib.toStr(target);
+
+          // add authorized role if not already added
+          if (_authorizedFunctions[targetStr][authorizedRoleId].length == 0) {
+               _authorizedRoles[targetStr].push(authorizedRoleId);
+          }
+
+          return _authorizedFunctions[targetStr][authorizedRoleId];
      }
 
+
      /// @dev Use this method to authorize a specific function authorization
      function _authorize(IAccess.FunctionInfo[] storage functions, bytes4 selector, string memory name) internal {
           functions.push(
@@ -86,5 +317,4 @@ contract ServiceAuthorization
                     name: StrLib.toStr(name),
                     createdAt: TimestampLib.blockTimestamp()}));
      }
-}
-
+}

package/contracts/distribution/BasicDistribution.sol

@@ -1,14 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {Distribution} from "./Distribution.sol";
 import {IAuthorization} from "../authorization/IAuthorization.sol";
-import {NftId} from "../type/NftId.sol";
-import {ReferralId} from "../type/Referral.sol";
-import {Fee} from "../type/Fee.sol";
-import {UFixed} from "../type/UFixed.sol";
+
+import {Distribution} from "./Distribution.sol";
 import {DistributorType} from "../type/DistributorType.sol";
+import {DISTRIBUTOR} from "../type/ObjectType.sol";
+import {Fee} from "../type/Fee.sol";
+import {NftId, NftIdLib} from "../type/NftId.sol";
+import {ReferralId} from "../type/Referral.sol";
+import {Seconds} from "../type/Seconds.sol";
 import {Timestamp} from "../type/Timestamp.sol";
+import {UFixed} from "../type/UFixed.sol";
 
 
 contract BasicDistribution is
@@ -36,15 +39,15 @@ contract BasicDistribution is
         UFixed maxDiscountPercentage,
         UFixed commissionPercentage,
         uint32 maxReferralCount,
-        uint32 maxReferralLifetime,
+        Seconds maxReferralLifetime,
         bool allowSelfReferrals,
         bool allowRenewals,
         bytes memory data
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
         returns (DistributorType distributorType)
     {
         return _createDistributorType(
@@ -66,24 +69,25 @@ contract BasicDistribution is
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
         returns(NftId distributorNftId)
     {
         return _createDistributor(distributor, distributorType, data);
     }
 
-    function updateDistributorType(
+    function changeDistributorType(
         NftId distributorNftId,
         DistributorType distributorType,
         bytes memory data
     )
         external
         virtual
-        onlyOwner()
         restricted()
+        onlyOwner()
+        onlyNftOfType(distributorNftId, DISTRIBUTOR())
     {
-        _updateDistributorType(distributorNftId, distributorType, data);
+        _changeDistributorType(distributorNftId, distributorType, data);
     }
 
     /**
@@ -91,6 +95,7 @@ contract BasicDistribution is
      * referral codes need to be unique
      */
     function createReferral(
+        NftId distributorNftId,
         string memory code,
         UFixed discountPercentage,
         uint32 maxReferrals,
@@ -99,11 +104,11 @@ contract BasicDistribution is
     )
         external
         virtual
-        onlyDistributor()
         restricted()
+        onlyNftOwner(distributorNftId)
         returns (ReferralId referralId)
     {
-        NftId distributorNftId = getDistributorNftId(msg.sender);
+        _checkNftType(distributorNftId, DISTRIBUTOR());
         return _createReferral(
             distributorNftId,
             code,
@@ -118,8 +123,7 @@ contract BasicDistribution is
         NftId instanceNftId,
         IAuthorization authorization, 
         address initialOwner,
-        string memory name,
-        address token
+        string memory name
     )
         internal
         virtual
@@ -129,10 +133,9 @@ contract BasicDistribution is
             registry, 
             instanceNftId, 
             authorization,
+            false,
             initialOwner, 
             name, 
-            token, 
-            "", // registry data
             ""); // component specifc data
     }
 }