Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: use context-based role assignments to implement the permission model #19

Draft
wants to merge 19 commits into
base: main
Choose a base branch
from
Draft
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
8d429e3
feat: more powerful access control base contract
hiddentao Feb 23, 2025
2fa2d2e
refactor: port existing code over to using new access control base
hiddentao Feb 23, 2025
d473e38
feat: name wrapper registry utilising new ACL system
hiddentao Feb 23, 2025
ae0012b
refactor: better method names
hiddentao Feb 23, 2025
67ed76d
feat: generate token id context so that we can keep role assignments …
hiddentao Feb 23, 2025
6b722d0
refactor: use a flag for transfer locks instead
hiddentao Feb 23, 2025
13fd262
test: grantRole return value
hiddentao Feb 23, 2025
8a76088
fix: allowOwnerToRenew is to be called by the emancipator
hiddentao Feb 23, 2025
8739269
refactor: improvements based on review feedback
hiddentao Feb 25, 2025
33b75e4
refactor: updates based on feedback
hiddentao Feb 25, 2025
1f15b51
refactor: simplify roles by introducing role groups
hiddentao Feb 26, 2025
e9d4c9e
refactor: renamed context to resource
hiddentao Feb 28, 2025
4f0cb04
refactor: acl roles are now a 256-bit bitmap and set against context
hiddentao Mar 5, 2025
8bbed09
feat: can revoke all roles for user within a context and copy roles f…
hiddentao Mar 5, 2025
be3a052
chore: work towards new acl system
hiddentao Mar 5, 2025
28c9213
fix: tests for new acl
hiddentao Mar 6, 2025
9610d25
refactor: simplify acl to allow for easy role bitmap construction
hiddentao Mar 6, 2025
74c865b
refactor: eth registry now works with new roles arch
hiddentao Mar 7, 2025
c55304e
chore: rewrote name wrapper for new scheme
hiddentao Mar 7, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix: tests for new acl
  • Loading branch information
hiddentao committed Mar 6, 2025
commit 28c9213c7912807cfb3c413bf1c44bb552ab86ac
3 changes: 3 additions & 0 deletions contracts/src/registry/Roles.sol
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ pragma solidity >=0.8.13;
* We define everything here so that we can (a) avoid accidental clashes, and (b) define globally unique roles.
*/
abstract contract Roles {
/*
NOTE: DEFAULT_ADMIN_ROLE is 1, so all other roles are > 1
*/
uint8 public constant ROLE_SET_SUBREGISTRY = 2;
uint8 public constant ROLE_SET_RESOLVER = 3;
uint8 public constant ROLE_TLD_ISSUER = 4;
Expand Down
7 changes: 4 additions & 3 deletions contracts/test/EnhancedAccessControl.t.sol
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ contract EnhancedAccessControlTest is Test {
uint8 public constant ROLE_A = 2;
uint8 public constant ROLE_B = 3;
uint8 public constant ROLE_C = 4;
uint8 public constant ROLE_D = 5;
bytes32 public constant RESOURCE_1 = bytes32(keccak256("RESOURCE_1"));
bytes32 public constant RESOURCE_2 = bytes32(keccak256("RESOURCE_2"));

Expand Down Expand Up @@ -109,7 +110,7 @@ contract EnhancedAccessControlTest is Test {

// Test granting a mix of new and existing roles
vm.recordLogs();
uint256 mixedRoleBitmap = (1 << ROLE_A) | (1 << 4); // ROLE_A already granted, role 4 is new
uint256 mixedRoleBitmap = (1 << ROLE_A) | (1 << ROLE_D); // ROLE_A already granted, ROLE_D is new

access.grantRoles(RESOURCE_1, mixedRoleBitmap, user1);

Expand Down Expand Up @@ -223,15 +224,15 @@ contract EnhancedAccessControlTest is Test {
}

function test_Revert_unauthorized_grant() public {
vm.expectRevert(abi.encodeWithSelector(EnhancedAccessControl.EnhancedAccessControlUnauthorizedAccountRole.selector, RESOURCE_1, access.DEFAULT_ADMIN_ROLE(), user1));
vm.expectRevert(abi.encodeWithSelector(EnhancedAccessControl.EnhancedAccessControlUnauthorizedAccountAdminRole.selector, RESOURCE_1, ROLE_A, user1));
vm.prank(user1);
access.grantRole(RESOURCE_1, ROLE_A, user2);
}

function test_Revert_unauthorized_revoke() public {
access.grantRole(RESOURCE_1, ROLE_A, user2);

vm.expectRevert(abi.encodeWithSelector(EnhancedAccessControl.EnhancedAccessControlUnauthorizedAccountRole.selector, RESOURCE_1, access.DEFAULT_ADMIN_ROLE(), user1));
vm.expectRevert(abi.encodeWithSelector(EnhancedAccessControl.EnhancedAccessControlUnauthorizedAccountAdminRole.selector, RESOURCE_1, ROLE_A, user1));
vm.prank(user1);
access.revokeRole(RESOURCE_1, ROLE_A, user2);
}
Expand Down
2 changes: 1 addition & 1 deletion contracts/test/RootRegistry.t.sol
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ contract TestRootRegistry is Test, ERC1155Holder, Roles {

function test_register_locked_resolver_and_subregistry() public {
uint256 expectedId = uint256(keccak256("test2"));
uint256 tokenId = registry.mint("test2", address(this), registry, 0, lockedResolverRoleBitmap | lockedSubregistryRoleBitmap, "");
uint256 tokenId = registry.mint("test2", address(this), registry, 0, 0, "");
vm.assertEq(tokenId, expectedId);
assertEq(registry.hasRole(registry.tokenIdResource(tokenId), ROLE_SET_SUBREGISTRY, address(this)), false);
assertEq(registry.hasRole(registry.tokenIdResource(tokenId), ROLE_SET_RESOLVER, address(this)), false);
Expand Down
Loading