Skip to content

Commit e374517

Browse files
author
telome
committed
Remove role system
1 parent 3f47478 commit e374517

File tree

3 files changed

+98
-109
lines changed

3 files changed

+98
-109
lines changed

‎deploy/NFATInit.sol‎

Lines changed: 9 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -22,25 +22,20 @@ interface NFATFacilityLike {
2222
function gem() external view returns (address);
2323
function almProxy() external view returns (address);
2424
function file(bytes32, address) external;
25-
function setUserRole(address, uint8, bool) external;
26-
function setRoleAction(uint8, bytes4, bool) external;
27-
function stop() external;
28-
function claim(address, uint256) external;
25+
function kiss(address) external;
26+
function addFreezer(address) external;
2927
}
3028

3129
struct NFATConfig {
3230
bytes32 facilityKey;
3331
address almProxy;
3432
address identityNetwork;
35-
address lpha;
36-
address[] pausers;
33+
address operator;
34+
address[] freezers;
3735
}
3836

3937
library NFATInit {
4038

41-
uint8 constant PAUSER = 1;
42-
uint8 constant LPHA = 2;
43-
4439
function init(
4540
DssInstance memory dss,
4641
address facility_,
@@ -57,18 +52,15 @@ library NFATInit {
5752

5853
facility.file("identityNetwork", cfg.identityNetwork);
5954

60-
// --- Configure pauser role ---
61-
62-
facility.setRoleAction(PAUSER, NFATFacilityLike.stop.selector, true);
55+
// --- Configure freezers ---
6356

64-
for (uint256 i = 0; i < cfg.pausers.length; ++i) {
65-
facility.setUserRole(cfg.pausers[i], PAUSER, true);
57+
for (uint256 i = 0; i < cfg.freezers.length; ++i) {
58+
facility.addFreezer(cfg.freezers[i]);
6659
}
6760

68-
// --- Configure lpha role ---
61+
// --- Configure operator ---
6962

70-
facility.setRoleAction(LPHA, NFATFacilityLike.claim.selector, true);
71-
facility.setUserRole(cfg.lpha, LPHA, true);
63+
facility.kiss(cfg.operator);
7264

7365
// --- Chainlog ---
7466

‎src/NFATFacility.sol‎

Lines changed: 32 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,9 @@ contract NFATFacility {
4646

4747
// --- Access Control Storage ---
4848

49-
mapping(address usr => uint256 allowed) public wards;
50-
mapping(address usr => bytes32 rolesData) public userRoles;
51-
mapping(bytes4 sig => bytes32 rolesData) public actionsRoles;
49+
mapping(address usr => uint256 allowed) public wards;
50+
mapping(address usr => uint256 allowed) public buds; // Operator(s) (lpha-nfat beacon)
51+
mapping(address usr => uint256 allowed) public cops; // Freezers
5252
bool public stopped;
5353
address public identityNetwork;
5454

@@ -74,8 +74,10 @@ contract NFATFacility {
7474

7575
event Rely(address indexed usr);
7676
event Deny(address indexed usr);
77-
event SetUserRole(address indexed who, uint8 indexed role, bool enabled);
78-
event SetRoleAction(uint8 indexed role, bytes4 sig, bool enabled);
77+
event Kiss(address indexed usr);
78+
event Diss(address indexed usr);
79+
event AddFreezer(address indexed usr);
80+
event RemoveFreezer(address indexed usr);
7981
event Stop();
8082
event Start();
8183
event File(bytes32 indexed what, address data);
@@ -104,12 +106,13 @@ contract NFATFacility {
104106
_;
105107
}
106108

107-
modifier roleAuth() {
108-
require(
109-
userRoles[msg.sender] & actionsRoles[msg.sig] != bytes32(0) ||
110-
wards[msg.sender] == 1,
111-
"NFATFacility/role-not-authorized"
112-
);
109+
modifier toll() {
110+
require(buds[msg.sender] == 1 || wards[msg.sender] == 1, "NFATFacility/not-operator");
111+
_;
112+
}
113+
114+
modifier cop() {
115+
require(cops[msg.sender] == 1 || wards[msg.sender] == 1, "NFATFacility/not-freezer");
113116
_;
114117
}
115118

@@ -141,27 +144,27 @@ contract NFATFacility {
141144
emit Deny(usr);
142145
}
143146

144-
function setUserRole(address who, uint8 role, bool enabled) external auth {
145-
bytes32 mask = bytes32(uint256(1) << role);
146-
if (enabled) {
147-
userRoles[who] |= mask;
148-
} else {
149-
userRoles[who] &= ~mask;
150-
}
151-
emit SetUserRole(who, role, enabled);
147+
function kiss(address usr) external auth {
148+
buds[usr] = 1;
149+
emit Kiss(usr);
152150
}
153151

154-
function setRoleAction(uint8 role, bytes4 sig, bool enabled) external auth {
155-
bytes32 mask = bytes32(uint256(1) << role);
156-
if (enabled) {
157-
actionsRoles[sig] |= mask;
158-
} else {
159-
actionsRoles[sig] &= ~mask;
160-
}
161-
emit SetRoleAction(role, sig, enabled);
152+
function diss(address usr) external auth {
153+
buds[usr] = 0;
154+
emit Diss(usr);
155+
}
156+
157+
function addFreezer(address usr) external auth {
158+
cops[usr] = 1;
159+
emit AddFreezer(usr);
162160
}
163161

164-
function stop() external roleAuth {
162+
function removeFreezer(address usr) external auth {
163+
cops[usr] = 0;
164+
emit RemoveFreezer(usr);
165+
}
166+
167+
function stop() external cop {
165168
stopped = true;
166169
emit Stop();
167170
}
@@ -177,22 +180,6 @@ contract NFATFacility {
177180
emit File(what, data);
178181
}
179182

180-
/// @notice Check if a user has a specific role
181-
/// @param usr The address to check
182-
/// @param role The role ID
183-
/// @return has Whether the user has the role
184-
function hasUserRole(address usr, uint8 role) external view returns (bool has) {
185-
has = userRoles[usr] & bytes32(uint256(1) << role) != bytes32(0);
186-
}
187-
188-
/// @notice Check if an action is assigned to a role
189-
/// @param sig The function signature
190-
/// @param role The role ID
191-
/// @return has Whether the action is in the role
192-
function isActionInRole(bytes4 sig, uint8 role) external view returns (bool has) {
193-
has = actionsRoles[sig] & bytes32(uint256(1) << role) != bytes32(0);
194-
}
195-
196183
// --- Queue Functions ---
197184

198185
/// @notice Prime deposits gem into the queue
@@ -227,7 +214,7 @@ contract NFATFacility {
227214
/// @notice Sentinel claims from queue, mints NFAT to target
228215
/// @param target The Prime address to mint the NFAT to
229216
/// @param amount The amount of gem to claim
230-
function claim(address target, uint256 amount) external roleAuth notStopped {
217+
function claim(address target, uint256 amount) external toll notStopped {
231218
require(amount > 0, "NFATFacility/zero-amount");
232219
require(deposits[target] >= amount, "NFATFacility/insufficient-deposits");
233220

‎test/NFATFacility.t.sol‎

Lines changed: 57 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,15 @@ contract NFATFacilityTest is DssTest {
3939

4040
address almProxy = address(0xA1);
4141
address pauseProxy;
42-
address lpha = address(0xC1);
43-
address pauser = address(0xC2);
42+
address operator = address(0xC1);
43+
address freezer = address(0xC2);
4444
address prime1 = address(0xB1);
4545
address prime2 = address(0xB2);
4646

47-
event SetUserRole(address indexed who, uint8 indexed role, bool enabled);
48-
event SetRoleAction(uint8 indexed role, bytes4 sig, bool enabled);
47+
event Kiss(address indexed usr);
48+
event Diss(address indexed usr);
49+
event AddFreezer(address indexed usr);
50+
event RemoveFreezer(address indexed usr);
4951
event Stop();
5052
event Start();
5153
event Subscribe(address indexed depositor, uint256 amount);
@@ -73,14 +75,14 @@ contract NFATFacilityTest is DssTest {
7375
susds = SUsdsLike(address(facility.gem()));
7476

7577
// Init via NFATInit as pauseProxy
76-
address[] memory pausers = new address[](1);
77-
pausers[0] = pauser;
78+
address[] memory _freezers = new address[](1);
79+
_freezers[0] = freezer;
7880
NFATConfig memory cfg = NFATConfig({
7981
facilityKey: "NFAT_FAC_HALO1",
8082
almProxy: almProxy,
8183
identityNetwork: address(0),
82-
lpha: lpha,
83-
pausers: pausers
84+
operator: operator,
85+
freezers: _freezers
8486
});
8587
vm.startPrank(pauseProxy);
8688
NFATInit.init(dss, facility_, cfg);
@@ -101,7 +103,7 @@ contract NFATFacilityTest is DssTest {
101103

102104
function _claim(address target, uint256 amount) internal returns (uint256 tokenId) {
103105
tokenId = facility.nextTokenId();
104-
vm.prank(lpha); facility.claim(target, amount);
106+
vm.prank(operator); facility.claim(target, amount);
105107
}
106108

107109
function _fundToken(uint256 tokenId, uint256 amount) internal {
@@ -115,13 +117,11 @@ contract NFATFacilityTest is DssTest {
115117
function testDeployAndInit() public view {
116118
assertEq(facility.wards(pauseProxy), 1);
117119

118-
// Pauser role configured by init
119-
assertTrue(facility.hasUserRole(pauser, NFATInit.PAUSER));
120-
assertTrue(facility.isActionInRole(facility.stop.selector, NFATInit.PAUSER));
120+
// Freezer configured by init
121+
assertEq(facility.cops(freezer), 1);
121122

122-
// Lpha role configured by init
123-
assertTrue(facility.hasUserRole(lpha, NFATInit.LPHA));
124-
assertTrue(facility.isActionInRole(facility.claim.selector, NFATInit.LPHA));
123+
// Operator configured by init
124+
assertEq(facility.buds(operator), 1);
125125

126126
// Chainlog entry
127127
assertEq(dss.chainlog.getAddress("NFAT_FAC_HALO1"), address(facility));
@@ -140,57 +140,67 @@ contract NFATFacilityTest is DssTest {
140140
function testModifiers() public {
141141
vm.startPrank(address(0xBEEF));
142142
checkModifier(address(facility), "NFATFacility/not-authorized", [
143-
facility.setUserRole.selector,
144-
facility.setRoleAction.selector,
143+
facility.kiss.selector,
144+
facility.diss.selector,
145+
facility.addFreezer.selector,
146+
facility.removeFreezer.selector,
145147
facility.start.selector
146148
]);
147-
checkModifier(address(facility), "NFATFacility/role-not-authorized", [
148-
facility.stop.selector,
149+
vm.stopPrank();
150+
151+
checkModifier(address(facility), "NFATFacility/not-operator", [
149152
facility.claim.selector
150153
]);
151-
vm.stopPrank();
154+
checkModifier(address(facility), "NFATFacility/not-freezer", [
155+
facility.stop.selector
156+
]);
152157
}
153158

154-
function testSetUserRole() public {
155-
vm.startPrank(pauseProxy);
159+
function testKissDiss() public {
160+
address who = address(0xb0b);
161+
assertEq(facility.buds(who), 0);
162+
156163
vm.expectEmit(true, true, true, true);
157-
emit SetUserRole(prime1, 1, true);
158-
facility.setUserRole(prime1, 1, true);
159-
assertTrue(facility.hasUserRole(prime1, 1));
164+
emit Kiss(who);
165+
vm.prank(pauseProxy); facility.kiss(who);
166+
assertEq(facility.buds(who), 1);
160167

161-
facility.setUserRole(prime1, 1, false);
162-
assertTrue(!facility.hasUserRole(prime1, 1));
163-
vm.stopPrank();
168+
vm.expectEmit(true, true, true, true);
169+
emit Diss(who);
170+
vm.prank(pauseProxy); facility.diss(who);
171+
assertEq(facility.buds(who), 0);
164172
}
165173

166-
function testSetRoleAction() public {
167-
bytes4 sig = facility.claim.selector;
168-
vm.startPrank(pauseProxy);
174+
function testAddRemoveFreezer() public {
175+
address who = address(0xb0b);
176+
assertEq(facility.cops(who), 0);
177+
169178
vm.expectEmit(true, true, true, true);
170-
emit SetRoleAction(1, sig, true);
171-
facility.setRoleAction(1, sig, true);
172-
assertTrue(facility.isActionInRole(sig, 1));
179+
emit AddFreezer(who);
180+
vm.prank(pauseProxy); facility.addFreezer(who);
181+
assertEq(facility.cops(who), 1);
173182

174-
facility.setRoleAction(1, sig, false);
175-
assertTrue(!facility.isActionInRole(sig, 1));
176-
vm.stopPrank();
183+
vm.expectEmit(true, true, true, true);
184+
emit RemoveFreezer(who);
185+
vm.prank(pauseProxy); facility.removeFreezer(who);
186+
assertEq(facility.cops(who), 0);
177187
}
178188

179189
function testStopStart() public {
180190
_subscribe(prime1, 100 ether);
181191

182192
// claim works before stop
183-
vm.prank(lpha); facility.claim(prime1, 25 ether);
193+
vm.prank(operator); facility.claim(prime1, 25 ether);
184194

185195
// stop
186196
vm.expectEmit(true, true, true, true);
187197
emit Stop();
188-
vm.prank(pauser); facility.stop();
198+
vm.prank(freezer); facility.stop();
189199
assertTrue(facility.stopped());
190200

191201
// claim reverts while stopped
192202
vm.expectRevert("NFATFacility/stopped");
193-
vm.prank(lpha); facility.claim(prime1, 25 ether);
203+
vm.prank(operator); facility.claim(prime1, 25 ether);
194204

195205
// start
196206
vm.expectEmit(true, true, true, true);
@@ -199,7 +209,7 @@ contract NFATFacilityTest is DssTest {
199209
assertTrue(!facility.stopped());
200210

201211
// claim works again after start
202-
vm.prank(lpha); facility.claim(prime1, 25 ether);
212+
vm.prank(operator); facility.claim(prime1, 25 ether);
203213
}
204214

205215
// --- Queue ---
@@ -279,22 +289,22 @@ contract NFATFacilityTest is DssTest {
279289
_subscribe(prime1, 100 ether);
280290

281291
vm.expectRevert("NFATFacility/zero-amount");
282-
vm.prank(lpha); facility.claim(prime1, 0);
292+
vm.prank(operator); facility.claim(prime1, 0);
283293
}
284294

285295
function testRevertClaimInsufficientDeposits() public {
286296
_subscribe(prime1, 100 ether);
287297

288298
vm.expectRevert("NFATFacility/insufficient-deposits");
289-
vm.prank(lpha); facility.claim(prime1, 101 ether);
299+
vm.prank(operator); facility.claim(prime1, 101 ether);
290300
}
291301

292302
function testRevertClaimStopped() public {
293303
_subscribe(prime1, 100 ether);
294304
vm.prank(pauseProxy); facility.stop();
295305

296306
vm.expectRevert("NFATFacility/stopped");
297-
vm.prank(lpha); facility.claim(prime1, 50 ether);
307+
vm.prank(operator); facility.claim(prime1, 50 ether);
298308
}
299309

300310
function testClaimWithIdentityNetwork() public {
@@ -313,7 +323,7 @@ contract NFATFacilityTest is DssTest {
313323
_subscribe(prime1, 100 ether);
314324

315325
vm.expectRevert("NFATFacility/target-not-member");
316-
vm.prank(lpha); facility.claim(prime1, 50 ether);
326+
vm.prank(operator); facility.claim(prime1, 50 ether);
317327
}
318328

319329
// --- Fund ---
@@ -524,8 +534,8 @@ contract NFATFacilityTest is DssTest {
524534

525535
// Operator approves
526536
vm.prank(prime1); facility.setApprovalForAll(prime2, true);
527-
vm.prank(prime2); facility.approve(lpha, tokenId);
528-
assertEq(facility.getApproved(tokenId), lpha);
537+
vm.prank(prime2); facility.approve(operator, tokenId);
538+
assertEq(facility.getApproved(tokenId), operator);
529539
}
530540

531541
function testRevertApproveNotAuthorized() public {

0 commit comments

Comments
 (0)