@etherisc/gif-next 3.0.0-61b9ecf-774 → 3.0.0-65fa82c-553

package/contracts/examples/flight/FlightProductAuthorization.sol

@@ -3,19 +3,42 @@ pragma solidity ^0.8.20;
 
 import {IAccess} from "../../../contracts/authorization/IAccess.sol";
 
+import {AccessAdminLib} from "../../authorization/AccessAdminLib.sol";
 import {BasicProductAuthorization} from "../../product/BasicProductAuthorization.sol";
 import {FlightProduct} from "./FlightProduct.sol";
 import {ORACLE} from "../../../contracts/type/ObjectType.sol";
-import {PUBLIC_ROLE} from "../../../contracts/type/RoleId.sol";
+import {RoleId, ADMIN_ROLE, PUBLIC_ROLE} from "../../../contracts/type/RoleId.sol";
 
 
 contract FlightProductAuthorization
     is BasicProductAuthorization
 {
 
-    constructor(string memory poolName)
-        BasicProductAuthorization(poolName)
-    {}
+    uint64 public constant STATISTICS_PROVIDER_ROLE_IDX = 1; // 1st custom role for flight product
+    string public constant STATISTICS_PROVIDER_ROLE_NAME = "StatisticsProviderRole";
+    RoleId public STATISTICS_PROVIDER_ROLE;
+
+
+    constructor(string memory productName)
+        BasicProductAuthorization(productName)
+    { }
+
+
+    function _setupRoles()
+        internal
+        override
+    {
+        STATISTICS_PROVIDER_ROLE = AccessAdminLib.getCustomRoleId(STATISTICS_PROVIDER_ROLE_IDX);
+
+        _addRole(
+            STATISTICS_PROVIDER_ROLE,
+            AccessAdminLib.roleInfo(
+                ADMIN_ROLE(),
+                TargetType.Custom,
+                1, // max member count special case: instance nft owner is sole role owner
+                STATISTICS_PROVIDER_ROLE_NAME));
+    }
+
 
     function _setupTargetAuthorizations()
         internal
@@ -28,13 +51,14 @@ contract FlightProductAuthorization
         functions = _authorizeForTarget(getMainTargetName(), getServiceRole(ORACLE()));
         _authorize(functions, FlightProduct.flightStatusCallback.selector, "flightStatusCallback");
 
-        // authorize public role (open access to any account, only allows to lock target)
-        functions = _authorizeForTarget(getMainTargetName(), PUBLIC_ROLE());
-        _authorize(functions, FlightProduct.createPolicy.selector, "createPolicy");
+        // authorize statistics provider role 
+        functions = _authorizeForTarget(getMainTargetName(), STATISTICS_PROVIDER_ROLE);
         _authorize(functions, FlightProduct.createPolicyWithPermit.selector, "createPolicyWithPermit");
 
-        // TODO: only owner
+        // authorize public role (additional authz via onlyOwner)
+        functions = _authorizeForTarget(getMainTargetName(), PUBLIC_ROLE());
         _authorize(functions, FlightProduct.processFlightStatus.selector, "processFlightStatus");
+        _authorize(functions, FlightProduct.processPayoutsAndClosePolicies.selector, "processPayoutsAndClosePolicies");
         _authorize(functions, FlightProduct.completeSetup.selector, "completeSetup");
         _authorize(functions, FlightProduct.setDefaultBundle.selector, "setDefaultBundle");
         _authorize(functions, FlightProduct.approveTokenHandler.selector, "approveTokenHandler");

package/contracts/instance/InstanceAdmin.sol

@@ -130,7 +130,6 @@ contract InstanceAdmin is
         _createTarget(target, name, TargetType.Instance, true); 
     }
 
-
     /// @dev Initializes the authorization for the specified component.
     /// Important: The component MUST be registered.
     function initializeComponentAuthorization(

package/contracts/instance/InstanceReader.sol

@@ -466,6 +466,12 @@ contract InstanceReader {
     }
 
 
+    /// @dev Returns the role ID for the given index.
+    function getRoleForName(string memory name) public view returns (RoleId roleId, bool exists) {
+        return _instanceAdmin.getRoleForName(name);
+    }
+
+
     /// @dev Returns the role ID for the instance owner role.
     /// This role may be used as a "root" admin role for other custom roles defined for this instance.
     function getInstanceOwnerRole() public pure returns (RoleId roleId) {

package/contracts/registry/RegistryAdmin.sol

@@ -85,7 +85,13 @@ contract RegistryAdmin is
                 registry, 
                 release); 
 
-        _checkAuthorization(authorization, REGISTRY(), release, false, true);
+        AccessAdminLib.checkAuthorization(
+            address(_authorization),
+            authorization, 
+            REGISTRY(), 
+            release, 
+            false, // expectServiceAuthorization
+            false); // checkAlreadyInitialized);
 
         _registry = registry;
         _authorization = IAuthorization(authorization);

package/contracts/registry/ReleaseAdmin.sol

@@ -72,7 +72,14 @@ contract ReleaseAdmin is
                 release);
 
         IServiceAuthorization serviceAuthorization = IServiceAuthorization(authorization);
-        _checkAuthorization(address(serviceAuthorization), RELEASE(), release, true, true);
+        AccessAdminLib.checkAuthorization(
+            address(_authorization),
+            address(serviceAuthorization), 
+            RELEASE(), 
+            release, 
+            true, // expectServiceAuthorization
+            true); // checkAlreadyInitialized);
+
         _serviceAuthorization = serviceAuthorization;
 
         // link nft ownability to registry

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@etherisc/gif-next",
-  "version": "3.0.0-61b9ecf-774",
+  "version": "3.0.0-65fa82c-553",
   "description": "This is the repository for the next version of the Generic Insurance Framework (GIF) smart contracts. ",
   "main": "index.js",
   "scripts": {