@etherisc/gif-next 0.0.2-ffba655 → 3.0.0-06d5e8b-738

package/contracts/authorization/AccessManagerCloneable.sol

@@ -0,0 +1,140 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import {AccessManagerUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagerUpgradeable.sol";
+import {IAccessManager} from "@openzeppelin/contracts/access/manager/IAccessManager.sol";
+
+import {InitializableERC165} from "../shared/InitializableERC165.sol";
+import {RegistryLinked} from "../shared/RegistryLinked.sol";
+import {VersionPart} from "../type/Version.sol";
+
+
+/// @dev An AccessManager based on OpenZeppelin that is cloneable and has a central lock property.
+/// The lock property allows to lock all services of a release in a central place.
+/// Cloned by upon release preparation and instance cloning.
+contract AccessManagerCloneable is
+    AccessManagerUpgradeable,
+    InitializableERC165,
+    RegistryLinked
+{
+    error ErrorAccessManagerCallerNotAdmin(address caller);
+    error ErrorAccessManagerRegistryAlreadySet(address registry);
+    error ErrorAccessManagerInvalidRelease(VersionPart release);
+
+    error ErrorAccessManagerTargetAdminLocked(address target);
+    error ErrorAccessManagerCallerAdminLocked(address caller);
+
+    VersionPart private _release;
+    bool private _isLocked;
+
+
+    modifier onlyAdminRole() {
+        (bool isMember, ) = hasRole(ADMIN_ROLE, msg.sender);
+        if(!isMember) {
+            revert ErrorAccessManagerCallerNotAdmin(msg.sender);
+        }
+        _;
+    }
+
+
+    function initialize(address admin)
+        public
+        initializer()
+    {
+        __ERC165_init();
+        __AccessManager_init(admin);
+
+        _registerInterface(type(IAccessManager).interfaceId);
+    }
+
+
+    /// @dev Completes the setup of the access manager.
+    /// Links the access manager to the registry and sets the release version.
+    function completeSetup(
+        address registry, 
+        VersionPart release
+    )
+        external
+        onlyAdminRole
+        reinitializer(uint64(release.toInt()))
+    {
+        _checkAndSetRegistry(registry);
+        _checkAndSetRelease(release);
+    }
+
+    /// @dev Returns true if the caller is authorized to call the target with the given selector and the manager lock is not set to locked.
+    /// Feturn values as in OpenZeppelin AccessManager.
+    /// For a locked manager the function reverts with ErrorAccessManagerTargetAdminLocked.
+    function canCall(
+        address caller,
+        address target,
+        bytes4 selector
+    )
+        public 
+        view 
+        virtual override 
+        returns (
+            bool immediate, 
+            uint32 delay
+        ) 
+    {
+        // locking of all contracts under control of this access manager
+        if (_isLocked) {
+            revert ErrorAccessManagerTargetAdminLocked(target);
+        }
+
+        (immediate, delay) = super.canCall(caller, target, selector);
+    }
+
+
+    /// @dev Locks/unlocks all services of this access manager.
+    /// Only the corresponding access admin can lock/unlock the services.
+    function setLocked(bool locked)
+        external
+        onlyAdminRole() 
+    {
+        _isLocked = locked;
+    }
+
+
+    /// @dev Returns the release version of this access manager.
+    /// For the registry admin release 3 is returned.
+    /// For the release admin and the instance admin the actual release version is returned.
+    function getRelease() external view returns (VersionPart release) {
+        return _release;
+    }
+
+
+    /// @dev Returns true iff all contracts of this access manager are locked.
+    function isLocked()
+        public
+        view
+        returns (bool)
+    {
+        return _isLocked;
+    }
+
+
+    function _checkAndSetRelease(VersionPart release)
+        internal
+    {
+        if (!release.isValidRelease()) {
+            revert ErrorAccessManagerInvalidRelease(release);
+        }
+
+        _release = release;
+    }
+
+
+    function _checkAndSetRegistry(address registry)
+        internal
+    {
+        // checks
+        if(address(getRegistry()) != address(0)) {
+            revert ErrorAccessManagerRegistryAlreadySet(address(getRegistry()) );
+        }
+
+        // effects
+        __RegistryLinked_init(registry);
+    }
+}

package/contracts/authorization/Authorization.sol

@@ -0,0 +1,190 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IAccess} from "./IAccess.sol";
+import {IAuthorization} from "./IAuthorization.sol";
+
+import {AccessAdminLib} from "./AccessAdminLib.sol";
+import {ObjectType} from "../type/ObjectType.sol";
+import {RoleId, RoleIdLib} from "../type/RoleId.sol";
+import {ServiceAuthorization} from "../authorization/ServiceAuthorization.sol";
+import {Str, StrLib} from "../type/String.sol";
+
+
+contract Authorization is
+    ServiceAuthorization,
+    IAuthorization
+{
+
+    // MUST match with AccessAdminLib.COMPONENT_ROLE_MIN
+    uint64 public constant COMPONENT_ROLE_MIN = 110000;
+    uint64 public constant INSTANCE_ROLE_MIN = 100000;
+
+    uint64 internal _nextGifContractRoleId;
+    uint64 internal _nextInstanceContractRoleId;
+
+    string internal _tokenHandlerName = "ComponentTh";
+    Str internal _tokenHandlerTarget;
+
+
+    constructor(
+        string memory mainTargetName, 
+        ObjectType domain,
+        uint8 release,
+        string memory commitHash,
+        IAccess.TargetType targetType,
+        bool includeTokenHandler
+    )
+        ServiceAuthorization(mainTargetName, domain, release, commitHash)
+    {
+        // IMPORTANT must match with AccessAdminLib.CORE_ROLE_MIN
+        _nextGifContractRoleId = 100;
+        _nextInstanceContractRoleId = INSTANCE_ROLE_MIN;
+
+        // setup main target
+        // special case: core targets
+        if (targetType == IAccess.TargetType.Core) {
+            _addGifTarget(_mainTargetName);
+        // special case instances
+        } else if (targetType == IAccess.TargetType.Instance) {
+            _addInstanceTarget(_mainTargetName);
+        // all other target types
+        } else {
+            if (domain.eqz()) {
+                revert ErrorAuthorizationTargetDomainZero();
+            }
+
+            RoleId mainRoleId = RoleIdLib.toRoleId(COMPONENT_ROLE_MIN);
+            string memory mainRoleName = _toTargetRoleName(_mainTargetName);
+
+            _addTargetWithRole(
+                _mainTargetName, 
+                mainRoleId,
+                mainRoleName);
+        }
+
+        // setup use case specific parts
+        _setupServiceTargets();
+        _setupRoles(); // not including main target role
+        _setupTargets(); // not including main target (and token handler target)
+        _setupTargetAuthorizations(); // not including token handler target
+
+        // setup component token handler 
+        if (includeTokenHandler) {
+            _tokenHandlerName = string(abi.encodePacked(mainTargetName, "Th"));
+            _tokenHandlerTarget = StrLib.toStr(_tokenHandlerName);
+            _addTarget(_tokenHandlerName);
+            _setupTokenHandlerAuthorizations();
+        }
+
+        _registerInterfaceNotInitializing(type(IAuthorization).interfaceId);
+    }
+
+
+    function getTokenHandlerName() public view returns(string memory) {
+        return _tokenHandlerName;
+    }
+
+    function getTokenHandlerTarget() public view returns(Str) {
+        return _tokenHandlerTarget;
+    }
+
+    function getTarget(string memory targetName) public pure returns(Str target) {
+        return StrLib.toStr(targetName);
+    }
+
+    function getTargets() external view returns(Str[] memory targets) {
+        return _targets;
+    }
+
+    function targetExists(Str target) external view returns(bool exists) {
+        return target == _mainTarget || _targetExists[target];
+    }
+
+    /// @dev Sets up the relevant service targets for the component.
+    /// Overwrite this function for use case specific authorizations.
+    // solhint-disable-next-line no-empty-blocks
+    function _setupServiceTargets() internal virtual { }
+
+    /// @dev Sets up the relevant (non-service) targets for the component.
+    /// Overwrite this function for use case specific authorizations.
+    // solhint-disable-next-line no-empty-blocks
+    function _setupTargets() internal virtual { }
+
+    /// @dev Sets up the relevant roles for the component.
+    /// Overwrite this function for use case specific authorizations.
+    // solhint-disable-next-line no-empty-blocks
+    function _setupRoles() internal virtual {}
+
+    /// @dev Sets up the relevant component's token handler authorizations.
+    /// Overwrite this function for use case specific authorizations.
+    // solhint-disable-next-line no-empty-blocks
+    function _setupTokenHandlerAuthorizations() internal virtual {}
+
+    /// @dev Sets up the relevant target authorizations for the component.
+    /// Overwrite this function for use case specific authorizations.
+    // solhint-disable-next-line no-empty-blocks
+    function _setupTargetAuthorizations() internal virtual {}
+
+
+    /// @dev Add a contract role for the provided role id and name.
+    function _addCustomRole(RoleId roleId, RoleId adminRoleId, uint32 maxMemberCount, string memory name) internal {
+        _addRole(
+            roleId,
+            AccessAdminLib.roleInfo(
+                adminRoleId,
+                TargetType.Custom,
+                maxMemberCount,
+                name));
+    }
+
+    /// @dev Add a gif target with its corresponding contract role
+    function _addGifTarget(string memory contractName) internal {
+        RoleId contractRoleId = RoleIdLib.toRoleId(_nextGifContractRoleId++);
+        string memory contractRoleName = string(
+            abi.encodePacked(
+                contractName,
+                ROLE_NAME_SUFFIX));
+
+        _addTargetWithRole(
+            contractName,
+            contractRoleId,
+            contractRoleName);
+    }
+
+    /// @dev Add an instance target with its corresponding contract role
+    function _addInstanceTarget(string memory contractName) internal {
+        RoleId contractRoleId = RoleIdLib.toRoleId(_nextInstanceContractRoleId++);
+        string memory contractRoleName = _toTargetRoleName(contractName);
+
+        _addTargetWithRole(
+            contractName, 
+            contractRoleId,
+            contractRoleName);
+    }
+
+    /// @dev Use this method to to add an authorized target.
+    function _addTarget(string memory name) internal {
+        _addTargetWithRole(name, RoleIdLib.zero(), "");
+    }
+
+
+    /// @dev Role id for targets registry, staking and instance
+    function _toTargetRoleId(ObjectType targetDomain) 
+        internal
+        pure
+        returns (RoleId targetRoleId)
+    {
+        return RoleIdLib.toRoleId(100 * targetDomain.toInt());
+    }
+
+
+    /// @dev Returns the role name for the specified target name
+    function _toTargetRoleName(string memory targetName) internal pure returns (string memory) {
+        return string(
+            abi.encodePacked(
+                targetName,
+                ROLE_NAME_SUFFIX));
+    }
+}
+

package/contracts/authorization/IAccess.sol

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import {Blocknumber} from "../type/Blocknumber.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {Selector} from "../type/Selector.sol";
+import {Str} from "../type/String.sol";
+import {Timestamp} from "../type/Timestamp.sol";
+
+interface IAccess {
+
+    enum TargetType {
+        Undefined, // no target must have this type
+        Core, // GIF core contracts
+        GenericService, // release independent service contracts
+        Service, // service contracts
+        Instance, // instance contracts
+        Component, // instance contracts
+        Contract, // normal contracts
+        Custom // use case specific rules for contracts or normal accounts
+    }
+
+    struct RoleInfo {
+        // slot 0
+        RoleId adminRoleId;  // 64
+        TargetType targetType; // ?
+        uint32 maxMemberCount; // 32
+        Timestamp createdAt; // 40
+        Timestamp pausedAt; // 40
+        Blocknumber lastUpdateIn; // 40
+        // slot 1
+        Str name; // 256
+    }
+
+
+    // TODO recalc slot allocation
+    struct TargetInfo {
+        Str name;
+        TargetType targetType;
+        RoleId roleId;
+        Timestamp createdAt;
+        Blocknumber lastUpdateIn;
+    }
+
+    struct FunctionInfo {
+        // slot 0
+        Str name; // function name
+        // slot 1
+        Selector selector; // function selector
+        Timestamp createdAt;
+        Blocknumber lastUpdateIn;
+    }
+
+    struct RoleNameInfo {
+        // slot 0
+        RoleId roleId;
+        bool exists;
+    }
+
+    struct TargeNameInfo {
+        // slot 0
+        address target;
+        bool exists;
+    }
+
+}

package/contracts/authorization/IAccessAdmin.sol

@@ -0,0 +1,142 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
+
+import {IAccess} from "./IAccess.sol";
+import {IAuthorization} from "./IAuthorization.sol";
+import {IRegistryLinked} from "../shared/IRegistryLinked.sol";
+import {IRelease} from "../registry/IRelease.sol";
+
+import {Blocknumber} from "../type/Blocknumber.sol";
+import {NftId} from "../type/NftId.sol";
+import {ObjectType} from "../type/ObjectType.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {Str} from "../type/String.sol";
+import {VersionPart} from "../type/Version.sol";
+
+/// @dev Base interface for registry admin, release admin, and instance admin 
+interface IAccessAdmin is 
+    IAccessManaged,
+    IAccess,
+    IRegistryLinked,
+    IRelease
+{
+
+    // roles, targets and functions
+    event LogAccessAdminRoleCreated(string admin, RoleId roleId, TargetType targetType, RoleId roleAdminId, string name);
+    event LogAccessAdminTargetCreated(string admin, string name, bool managed, address target, RoleId roleId);
+
+    event LogAccessAdminRoleActivatedSet(string admin, RoleId roleId, bool active, Blocknumber lastUpdateIn);
+    event LogAccessAdminRoleGranted(string admin, address account, string roleName);
+    event LogAccessAdminRoleRevoked(string admin, address account, string roleName);
+    event LogAccessAdminTargetLockedSet(string admin, address target, bool locked, Blocknumber lastUpdateIn);
+    event LogAccessAdminFunctionGranted(string admin, address target, string func, Blocknumber lastUpdateIn);
+
+    // only deployer modifier
+    error ErrorAccessAdminNotDeployer();
+
+    // only role admin modifier
+    error ErrorAccessAdminNotAdminOfRole(RoleId adminRoleId, address account);
+
+    // only role owner modifier
+    error ErrorAccessAdminNotRoleOwner(RoleId roleId, address account);
+
+    // role management
+    error ErrorAccessAdminInvalidUseOfAdminRole();
+    error ErrorAccessAdminInvalidUseOfPublicRole();
+    error ErrorAccessAdminRoleNotCustom(RoleId roleId);
+
+    // initialization
+    error ErrorAccessAdminNotRegistry(address registry);
+    error ErrorAccessAdminAuthorityNotContract(address authority);
+    error ErrorAccessAdminAccessManagerNotAccessManager(address authority);
+    error ErrorAccessAdminAccessManagerEmptyName();
+
+    // check target
+    error ErrorAccessAdminInvalidTargetType(address target, TargetType targetType);
+    error ErrorAccessAdminInvalidServiceType(address target, TargetType serviceTargetType);
+    error ErrorAccessAdminTargetNotCreated(address target);
+    error ErrorAccessAdminTargetNotRegistered(address target);
+    error ErrorAccessAdminTargetTypeMismatch(address target, ObjectType expectedType, ObjectType actualType);
+
+    // check authorization
+    error ErrorAccessAdminAlreadyInitialized(address authorization);
+    error ErrorAccessAdminNotAuthorization(address authorization);
+    error ErrorAccessAdminNotServiceAuthorization(address serviceAuthorization);
+    error ErrorAccessAdminDomainMismatch(address authorization, ObjectType expectedDomain, ObjectType actualDomain);
+    error ErrorAccessAdminReleaseMismatch(address authorization, VersionPart expectedRelease, VersionPart actualRelease);
+
+    // link to nft
+    error ErrorAccessAdminNotRegistered(address registerable);
+
+    // initialize authority
+    error ErrorAccessAdminAdminRoleMissing();
+
+    // create role
+    error ErrorAccessAdminRoleAlreadyCreated(RoleId roleId, string name);
+    error ErrorAccessAdminRoleAdminNotExisting(RoleId adminRoleId);
+    error ErrorAccessAdminRoleNameEmpty(RoleId roleId);
+    error ErrorAccessAdminRoleNameAlreadyExists(RoleId roleId, string name, RoleId existingRoleId);
+
+    // grant/revoke/renounce role
+    error ErrorAccessAdminRoleUnknown(RoleId roleId);
+    error ErrorAccessAdminRoleIsLocked(RoleId roleId);
+    error ErrorAccessAdminRoleIsPaused(RoleId roleId);
+    error ErrorAccessAdminRoleMembersLimitReached(RoleId roleId, uint256 memberCountLimit);
+    error ErrorAccessAdminRoleMemberNotContract(RoleId roleId, address notContract);
+    error ErrorAccessAdminRoleMemberRemovalDisabled(RoleId roleId, address expectedMember);
+
+    // create target
+    error ErrorAccessAdminTargetAlreadyCreated(address target, string name);
+    error ErrorAccessAdminTargetNameEmpty(address target);
+    error ErrorAccessAdminTargetNameAlreadyExists(address target, string name, address existingTarget);
+    error ErrorAccessAdminTargetNotAccessManaged(address target);
+    error ErrorAccessAdminTargetAuthorityMismatch(address expectedAuthority, address actualAuthority);
+
+    // lock target
+    error ErrorAccessAdminTagetNotLockable();
+    error ErrorAccessAdminTargetAlreadyLocked(address target, bool isLocked);
+
+    // authorize target functions
+    error ErrorAccessAdminNotComponentOrCustomTarget(address target);
+    error ErrorAccessAdminAuthorizeForAdminRoleInvalid(address target);
+
+    // toFunction
+    error ErrorAccessAdminSelectorZero();
+    error ErrorAccessAdminFunctionNameEmpty();
+
+    // check target
+    error ErrorAccessAdminTargetUnknown(address target);
+
+    //--- view functions ----------------------------------------------------//
+
+    function getAuthorization() external view returns (IAuthorization authorization);
+    function getLinkedNftId() external view returns (NftId linkedNftId);
+
+    function isLocked() external view returns (bool locked);
+
+    function roles() external view returns (uint256 numberOfRoles);
+    function getRoleId(uint256 idx) external view returns (RoleId roleId);
+
+    function roleExists(RoleId roleId) external view returns (bool exists); 
+    function getRoleForName(string memory name) external view returns (RoleId roleId, bool exists);
+    function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory roleInfo);
+    function isRoleActive(RoleId roleId) external view returns (bool isActive);
+    function isRoleCustom(RoleId roleId) external view returns (bool isCustom);
+
+    function isRoleMember(RoleId roleId, address account) external view returns (bool);
+    function isRoleAdmin(RoleId roleId, address account) external view returns (bool);
+    function roleMembers(RoleId roleId) external view returns (uint256 numberOfMembers);
+    function getRoleMember(RoleId roleId, uint256 idx) external view returns (address account);
+
+    function targetExists(address target) external view returns (bool exists);
+    function getTargetForName(Str name) external view returns (address target);
+    function targets() external view returns (uint256 numberOfTargets);
+    function getTargetAddress(uint256 idx) external view returns (address target);
+    function getTargetInfo(address target) external view returns (TargetInfo memory targetInfo);
+    function isTargetLocked(address target) external view returns (bool locked);
+
+    function authorizedFunctions(address target) external view returns (uint256 numberOfFunctions);
+    function getAuthorizedFunction(address target, uint256 idx) external view returns (FunctionInfo memory func, RoleId roleId);
+}

package/contracts/authorization/IAuthorization.sol

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IServiceAuthorization} from "./IServiceAuthorization.sol";
+import {Str} from "../type/String.sol";
+
+
+interface IAuthorization is 
+     IServiceAuthorization
+{
+
+     /// @dev Returns the token hander name.
+     /// Only components have a token handler.
+     function getTokenHandlerName() external view returns(string memory name);
+
+     /// @dev Returns the token hander target.
+     /// Only components have a token handler.
+     function getTokenHandlerTarget() external view returns(Str target);
+
+     /// @dev Returns the complete list of targets.
+     function getTargets() external view returns(Str[] memory targets);
+
+     /// @dev Returns true iff the specified target exists.
+     function targetExists(Str target) external view returns(bool exists);
+}
+

package/contracts/authorization/IServiceAuthorization.sol

@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
+import {IAccess} from "../authorization/IAccess.sol";
+import {ObjectType} from "../type/ObjectType.sol";
+import {RoleId} from "../type/RoleId.sol";
+import {Str} from "../type/String.sol";
+import {VersionPart} from "../type/Version.sol";
+
+interface IServiceAuthorization is 
+     IERC165, 
+     IAccess
+{
+
+     error ErrorAuthorizationMainTargetNameEmpty();
+     error ErrorAuthorizationTargetDomainZero();
+     error ErrorAuthorizationReleaseInvalid(uint8 release);
+     error ErrorAuthorizationCommitHashInvalid(string commitHash);
+
+     /// @dev Returns the main domain of the authorization.
+     function getDomain() external view returns(ObjectType targetDomain);
+
+     /// @dev Returns the release (VersionPart) for which the authorizations are defined by this contract.
+     /// Matches with the release returned by the linked service authorization.
+     function getRelease() external view returns(VersionPart release);
+
+     /// @dev Returns the commit hash for the related GIF release.
+     function getCommitHash() external view returns(string memory commitHash);
+
+     /// @dev Returns the main target id name as string.
+     /// This name is used to derive the target id and a corresponding target role name
+     /// Overwrite this function to change the basic pool target name.
+     function getMainTargetName() external view returns (string memory name);
+
+     /// @dev Returns the main target.
+     function getMainTarget() external view returns(Str target);
+
+     /// @dev Returns the full list of service domains for this release.
+     /// Services need to be registered for the release in revers order of this list.
+     function getServiceDomains() external view returns(ObjectType[] memory serviceDomains);
+
+     /// @dev Returns the service domain for the provided index.
+     function getServiceDomain(uint256 idx) external view returns(ObjectType serviceDomain);
+
+     /// @dev Returns the service target for the specified domain.
+     function getServiceTarget(ObjectType serviceDomain) external view returns(Str serviceTarget);
+
+     /// @dev Returns the service target for the specified domain.
+     function getServiceRole(ObjectType serviceDomain) external view returns(RoleId serviceRoleId);
+
+     /// @dev Returns the expected service address for the provided domain.
+     function getServiceAddress(ObjectType serviceDomain) external view returns(address service);
+
+     /// @dev Returns the role id associated with the target.
+     /// If no role is associated with the target the zero role id is returned.
+     function getTargetRole(Str target) external view returns(RoleId roleId);
+
+     /// @dev Returns true iff the role exists.
+     function roleExists(RoleId roleId) external view returns(bool exists);
+
+     /// @dev Returns the list of involved roles.
+     function getRoles() external view returns(RoleId[] memory roles);
+
+     /// @dev Returns the role info for the provided role id.
+     function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory roleInfo);
+
+     /// @dev Returns the name for the provided role id.
+     function getRoleName(RoleId roleId) external view returns (string memory roleName);
+
+     /// @dev For the given target the list of authorized role ids is returned
+     function getAuthorizedRoles(Str target) external view returns(RoleId[] memory roleIds);
+
+     /// @dev For the given target and role id the list of authorized functions is returned
+     function getAuthorizedFunctions(Str target, RoleId roleId) external view returns(FunctionInfo[] memory authorizatedFunctions);
+}
+