// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;

/**
 * @dev Contract module that allows children to implement role-based access
 * control mechanisms. This is a lightweight version that doesn't allow
 * enumerating role
 * members except through off-chain means by accessing the contract event logs.
 * Some
 * applications may benefit from on-chain enumerability, for those cases see
 * {AccessControlEnumerable}.
 *
 * Roles are referred to by their `bytes32` identifier. These should be exposed
 * in the external API and be unique. The best way to achieve this is by
 * using `public constant` hash digests:
 *
 * ```
 * bytes32 public constant MY_ROLE = keccak256("MY_ROLE");
 * ```
 *
 * Roles can be used to represent a set of permissions. To restrict access to a
 * function call, use {hasRole}:
 *
 * ```
 * function foo() public {
 *     require(hasRole(MY_ROLE, msg.sender));
 *     ...
 * }
 * ```
 *
 * Roles can be granted and revoked dynamically via the {grantRole} and
 * {revokeRole} functions. Each role has an associated admin role, and only
 * accounts that have a role's admin role can call {grantRole} and {revokeRole}.
 *
 * By default, the admin role for all roles is `DEFAULT_ADMIN_ROLE`, which means
 * that only accounts with this role will be able to grant or revoke other
 * roles. More complex role relationships can be created by using
 * {_setRoleAdmin}.
 *
 * WARNING: The `DEFAULT_ADMIN_ROLE` is also its own admin: it has permission to
 * grant and revoke this role. Extra precautions should be taken to secure
 * accounts that have been granted it.
 */
abstract contract AccessControl {
    /**
     * @dev Emitted when `newAdminRole` is set as ``role``'s admin role,
     * replacing `previousAdminRole`
     *
     * `DEFAULT_ADMIN_ROLE` is the starting admin for all roles, despite
     * {RoleAdminChanged} not being emitted signaling this.
     *
     * _Available since v3.1._
     */
    event RoleAdminChanged(bytes32 role, bytes32 previousAdminRole, bytes32 newAdminRole);

    /**
     * @dev Emitted when `account` is granted `role`.
     *
     * `sender` is the account that originated the contract call, an admin role
     * bearer except when using {AccessControl-_setupRole}.
     */
    event RoleGranted(bytes32 role, address account, address sender);

    /**
     * @dev Emitted when `account` is revoked `role`.
     *
     * `sender` is the account that originated the contract call:
     *   - if using `revokeRole`, it is the admin role bearer
     *   - if using `renounceRole`, it is the role bearer (i.e. `account`)
     */
    event RoleRevoked(bytes32 role, address account, address sender);

    struct RoleData {
        mapping(address => bool) members;
        bytes32 adminRole;
    }

    mapping(bytes32 => RoleData) private _roles;

    bytes32 internal constant DEFAULT_ADMIN_ROLE = 0x00;

    /**
     * @dev Modifier that checks that an account has a specific role. Reverts
     * with a standardized message including the required role.
     *
     * The format of the revert reason is given by the following regular
     * expression:
     *
     *  /^AccessControl: account (0x[0-9a-f]{40}) is missing role
     * (0x[0-9a-f]{64})$/
     *
     * _Available since v4.1._
     */
    modifier onlyRole(bytes32 role) {
        _checkRole(role, msg.sender);
        _;
    }

    /**
     * @dev Returns `true` if `account` has been granted `role`.
     */
    function hasRole(bytes32 role, address account) public view returns (bool) {
        return _roles[role].members[account];
    }

    /**
     * @dev Revert with a standard message if `account` is missing `role`.
     *
     * The format of the revert reason is given by the following regular
     * expression:
     *
     *  /^AccessControl: account (0x[0-9a-f]{40}) is missing role
     * (0x[0-9a-f]{64})$/
     */
    function _checkRole(bytes32 role, address account) internal view {
        if (!hasRole(role, account)) {
            revert("Account is missing role");
        }
    }

    /**
     * @dev Returns the admin role that controls `role`. See {grantRole} and
     * {revokeRole}.
     *
     * To change a role's admin, use {_setRoleAdmin}.
     */
    function getRoleAdmin(bytes32 role) public view returns (bytes32) {
        return _roles[role].adminRole;
    }

    /**
     * @dev Grants `role` to `account`.
     *
     * If `account` had not been already granted `role`, emits a {RoleGranted}
     * event.
     *
     * Requirements:
     *
     * - the caller must have ``role``'s admin role.
     */
    function grantRole(bytes32 role, address account) external onlyRole(getRoleAdmin(role)) {
        _grantRole(role, account);
    }

    /**
     * @dev Revokes `role` from `account`.
     *
     * If `account` had been granted `role`, emits a {RoleRevoked} event.
     *
     * Requirements:
     *
     * - the caller must have ``role``'s admin role.
     */
    function revokeRole(bytes32 role, address account) external onlyRole(getRoleAdmin(role)) {
        _revokeRole(role, account);
    }

    /**
     * @dev Revokes `role` from the calling account.
     *
     * Roles are often managed via {grantRole} and {revokeRole}: this function's
     * purpose is to provide a mechanism for accounts to lose their privileges
     * if they are compromised (such as when a trusted device is misplaced).
     *
     * If the calling account had been revoked `role`, emits a {RoleRevoked}
     * event.
     *
     * Requirements:
     *
     * - the caller must be `account`.
     */
    function renounceRole(bytes32 role, address account) external {
        require(account == msg.sender); // "AccessControl: can only renounce
            // roles for self"

        _revokeRole(role, account);
    }

    /**
     * @dev Sets `adminRole` as ``role``'s admin role.
     *
     * Emits a {RoleAdminChanged} event.
     */
    function _setRoleAdmin(bytes32 role, bytes32 adminRole) internal {
        bytes32 previousAdminRole = getRoleAdmin(role);
        _roles[role].adminRole = adminRole;
        emit RoleAdminChanged(role, previousAdminRole, adminRole);
    }

    /**
     * @dev Grants `role` to `account`.
     *
     * Internal function without access restriction.
     */
    function _grantRole(bytes32 role, address account) internal {
        if (!hasRole(role, account)) {
            _roles[role].members[account] = true;
            emit RoleGranted(role, account, msg.sender);
        }
    }

    /**
     * @dev Revokes `role` from `account`.
     *
     * Internal function without access restriction.
     */
    function _revokeRole(bytes32 role, address account) internal {
        if (hasRole(role, account)) {
            _roles[role].members[account] = false;
            emit RoleRevoked(role, account, msg.sender);
        }
    }
}

/*----------------------------------------------------------*|
|*          ███    ██ ██ ███    ██ ███████  █████           *|
|*          ████   ██ ██ ████   ██ ██      ██   ██          *|
|*          ██ ██  ██ ██ ██ ██  ██ █████   ███████          *|
|*          ██  ██ ██ ██ ██  ██ ██ ██      ██   ██          *|
|*          ██   ████ ██ ██   ████ ██      ██   ██          *|
|*----------------------------------------------------------*/

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;

import "./access/AccessControl.sol";

/**
 *
 * @title NinfaWhitelist                               *
 *                                                           *
 * @notice allowa lazy whitelist and access control          *
 *                                                           *
 * @custom:security-contact tech@ninfa.io                    *
 *
 */

// this contract will need to have the CURATOR_ROLE on the factory
// and to be the owner of the marketplace and auction contracts
contract NinfaWhitelist is AccessControl {

    address private feeAccount; // this is the address that will receive the fee

    bytes32 private DOMAIN_SEPARATOR;
    bytes32 private DOMAIN_TYPEHASH;
    bytes32 private WHITELIST_PERMIT_TYPEHASH;

    // keccak256("CURATOR_ROLE");
    bytes32 private constant CURATOR_ROLE = 0x850d585eb7f024ccee5e68e55f2c26cc72e1e6ee456acf62135757a5eb9d4a10;

    uint256 private flatFee;

    mapping(bytes => bool) private usedSignatures;

    mapping(address => bool) public isWhitelisted;

    struct WhitelistPermit {
        address collection;
        bool isWhitelisted;
        bytes32 collectionType;
        bytes32 salt;
    }

    event Whitelist(
        address collection, address indexed whitelister, bytes32 indexed collectionType, bool isWhitelisted
    );

    /**
     * @dev whoever has a valid signature can call the whitelistCollection
     * function, a flat fee could be payed of any
     * @param _permit contains information on what collection to whitelist and
     * if it should be whitelisted or not
     * @param _signature the signature of the curator
     */
    function whitelistCollection(WhitelistPermit calldata _permit, bytes memory _signature) external payable {
        require(msg.value >= flatFee);

        if (flatFee > 0) {
            _sendValue(feeAccount, flatFee);
        }

        address _signer = _recover(_permit, _signature);

        require(hasRole(CURATOR_ROLE, _signer) && !usedSignatures[_signature]);

        usedSignatures[_signature] = true;

        isWhitelisted[_permit.collection] = _permit.isWhitelisted;

        emit Whitelist(_permit.collection, msg.sender, _permit.collectionType, _permit.isWhitelisted);
    }

    /*----------------------------------------------------------*|
    |*  # RECOVER FUNCTIONS                                     *|
    |*----------------------------------------------------------*/

    function _recover(
        WhitelistPermit calldata _permit,
        bytes memory _signature
    )
        private
        view
        returns (address _signer)
    {
        bytes32 digest = keccak256(
            abi.encodePacked(
                "\x19\x01",
                DOMAIN_SEPARATOR,
                keccak256(
                    abi.encode(
                        WHITELIST_PERMIT_TYPEHASH,
                        _permit.collection,
                        _permit.isWhitelisted,
                        _permit.collectionType,
                        _permit.salt
                    )
                )
            )
        );

        bytes32 r;
        bytes32 s;
        uint8 v;

        assembly {
            r := mload(add(_signature, 0x20))
            s := mload(add(_signature, 0x40))
            v := byte(0, mload(add(_signature, 0x60)))
        }

        _signer = ecrecover(digest, v, r, s);
        if (_signer == address(0)) revert();
    }

    /*----------------------------------------------------------*|
    |*  # OWNER FUNCTIONS                                       *|
    |*----------------------------------------------------------*/

    function setFlatFee(uint256 _flatFee) external onlyRole(DEFAULT_ADMIN_ROLE) {
        flatFee = _flatFee;
    }

    function setFeeAccount(address _feeAccount) external onlyRole(DEFAULT_ADMIN_ROLE) {
        feeAccount = _feeAccount;
    }

    // this function is used to allow the curator to firectly whitelist a collection
    function whitelistCollection(address collection, bool isWhitelisted_) external onlyRole(CURATOR_ROLE) {
        isWhitelisted[collection] = isWhitelisted_;
    }

    function whitelistCollections(address[] memory collections, bool isWhitelisted_) external onlyRole(CURATOR_ROLE) {
        for (uint256 i = 0; i < collections.length; i++) {
            isWhitelisted[collections[i]] = isWhitelisted_;
        }
    }

    receive() external payable {
        revert();
    }

    /*----------------------------------------------------------*|
    |*  #  OTHER                                                *|
    |*----------------------------------------------------------*/

    function _sendValue(address _receiver, uint256 _amount) private {
        // solhint-disable-next-line avoid-low-level-calls
        (bool success,) = payable(_receiver).call{ value: _amount }("");
        require(success);
    }

    constructor(string memory _eip712DomainName) {
        DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)");
        WHITELIST_PERMIT_TYPEHASH =
            keccak256("WhitelistPermit(address collection,bool isWhitelisted,bytes32 collectionType,bytes32 salt)");

        DOMAIN_SEPARATOR = keccak256(
            abi.encode(
                DOMAIN_TYPEHASH,
                keccak256(bytes(_eip712DomainName)), // name
                block.chainid, // chainId
                address(this) // verifyingContract
            )
        );

        _grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
    }
}

{
  "compilationTarget": {
    "src/NinfaWhitelist.sol": "NinfaWhitelist"
  },
  "evmVersion": "paris",
  "libraries": {},
  "metadata": {
    "appendCBOR": false,
    "bytecodeHash": "none"
  },
  "optimizer": {
    "details": {
      "constantOptimizer": true,
      "cse": true,
      "deduplicate": true,
      "inliner": true,
      "jumpdestRemover": true,
      "orderLiterals": true,
      "peephole": true,
      "yul": true,
      "yulDetails": {
        "optimizerSteps": "dhfoDgvulfnTUtnIf:fDnTOc",
        "stackAllocation": true
      }
    },
    "runs": 4194304
  },
  "remappings": [
    ":ds-test/=lib/forge-std/lib/ds-test/src/",
    ":forge-std/=lib/forge-std/src/",
    ":openzeppelin-contracts/=lib/openzeppelin-contracts/",
    ":openzeppelin/=lib/openzeppelin-contracts/contracts/",
    ":solmate/=lib/solmate/src/",
    ":src/=src/",
    ":test/=test/"
  ],
  "viaIR": true
}