039_多链访问控制系统：跨链身份认证与权限同步机制

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@openzeppelin/contracts/token/ERC721/extensions/ERC721Enumerable.sol";
import "@openzeppelin/contracts/access/AccessControl.sol";

// 跨链身份代币合约
contract CrossChainIdentity is ERC721Enumerable, AccessControl {
    bytes32 public constant ISSUER_ROLE = keccak256("ISSUER_ROLE");
    
    // 身份属性
    struct IdentityInfo {
        string did;        // 去中心化标识符
        mapping(uint256 => bool) linkedChains;  // 已链接的链ID
        uint256 createdTime;  // 创建时间
        uint256 lastUpdated;  // 最后更新时间
    }
    
    // 链信息
    struct ChainInfo {
        uint256 chainId;    // 链ID
        address bridgeAddress;  // 桥接合约地址
        string chainName;   // 链名称
        bool isActive;      // 是否激活
    }
    
    mapping(uint256 => IdentityInfo) private _identityInfos;
    mapping(uint256 => ChainInfo) public supportedChains;
    uint256[] public chainIds;
    
    event IdentityCreated(uint256 indexed tokenId, string did, address indexed owner);
    event ChainLinked(uint256 indexed tokenId, uint256 indexed chainId);
    event ChainRegistered(uint256 indexed chainId, string chainName, address bridgeAddress);
    
    constructor(string memory name, string memory symbol) ERC721(name, symbol) {
        _setupRole(DEFAULT_ADMIN_ROLE, msg.sender);
        _setupRole(ISSUER_ROLE, msg.sender);
    }
    
    // 注册新链
    function registerChain(uint256 chainId, string memory chainName, address bridgeAddress) external onlyRole(DEFAULT_ADMIN_ROLE) {
        require(supportedChains[chainId].chainId == 0, "Chain already registered");
        
        supportedChains[chainId] = ChainInfo(chainId, bridgeAddress, chainName, true);
        chainIds.push(chainId);
        
        emit ChainRegistered(chainId, chainName, bridgeAddress);
    }
    
    // 吊销链
    function deactivateChain(uint256 chainId) external onlyRole(DEFAULT_ADMIN_ROLE) {
        require(supportedChains[chainId].chainId != 0, "Chain not found");
        supportedChains[chainId].isActive = false;
    }
    
    // 激活链
    function activateChain(uint256 chainId) external onlyRole(DEFAULT_ADMIN_ROLE) {
        require(supportedChains[chainId].chainId != 0, "Chain not found");
        supportedChains[chainId].isActive = true;
    }
    
    // 发行身份NFT
    function issueIdentity(address to, string memory did) external onlyRole(ISSUER_ROLE) returns (uint256) {
        uint256 tokenId = totalSupply() + 1;
        _mint(to, tokenId);
        
        IdentityInfo storage identity = _identityInfos[tokenId];
        identity.did = did;
        identity.createdTime = block.timestamp;
        identity.lastUpdated = block.timestamp;
        
        emit IdentityCreated(tokenId, did, to);
        return tokenId;
    }
    
    // 链接到其他链
    function linkToChain(uint256 tokenId, uint256 chainId) external onlyRole(ISSUER_ROLE) {
        require(_exists(tokenId), "Identity not found");
        require(supportedChains[chainId].chainId != 0 && supportedChains[chainId].isActive, "Invalid chain");
        
        IdentityInfo storage identity = _identityInfos[tokenId];
        identity.linkedChains[chainId] = true;
        identity.lastUpdated = block.timestamp;
        
        emit ChainLinked(tokenId, chainId);
    }
    
    // 检查是否已链接到特定链
    function isLinkedToChain(uint256 tokenId, uint256 chainId) public view returns (bool) {
        if (!_exists(tokenId) || supportedChains[chainId].chainId == 0) {
            return false;
        }
        return _identityInfos[tokenId].linkedChains[chainId];
    }
    
    // 获取身份信息
    function getIdentityInfo(uint256 tokenId) external view returns (string memory did, uint256 createdTime, uint256 lastUpdated) {
        require(_exists(tokenId), "Identity not found");
        
        IdentityInfo storage identity = _identityInfos[tokenId];
        return (identity.did, identity.createdTime, identity.lastUpdated);
    }
    
    // 获取支持的链数量
    function getSupportedChainCount() external view returns (uint256) {
        return chainIds.length;
    }
}

// 跨链访问控制合约
contract CrossChainAccessControl {
    // 事件
    event CrossChainAccessGranted(address indexed user, uint256 indexed tokenId, uint256 indexed chainId, bytes32 resourceId);
    event CrossChainAccessRevoked(address indexed user, uint256 indexed tokenId, uint256 indexed chainId, bytes32 resourceId);
    event BridgeAddressUpdated(uint256 indexed chainId, address bridgeAddress);
    event AccessVerified(address indexed user, uint256 indexed tokenId, bytes32 indexed resourceId, bool granted);
    
    // 跨链身份合约地址
    CrossChainIdentity public crossChainIdentity;
    
    // 资源访问权限
    mapping(uint256 => mapping(uint256 => mapping(bytes32 => bool))) public crossChainAccess;
    
    // 链桥地址
    mapping(uint256 => address) public bridgeAddresses;
    
    // 权限映射：从一个链的权限映射到另一个链
    mapping(uint256 => mapping(bytes32 => mapping(uint256 => bytes32))) public permissionMappings;
    
    // 权限同步状态
    struct SyncStatus {
        uint256 lastSyncTime;
        bool isSynced;
        uint256 syncBlock;
    }
    
    mapping(uint256 => mapping(uint256 => mapping(bytes32 => SyncStatus))) public syncStatus;
    
    // 权限验证阈值（时间戳）
    uint256 public syncThreshold = 3600; // 默认1小时
    
    // 角色定义
    bytes32 public constant ADMIN_ROLE = keccak256("ADMIN_ROLE");
    bytes32 public constant OPERATOR_ROLE = keccak256("OPERATOR_ROLE");
    
    constructor(address _crossChainIdentity) {
        crossChainIdentity = CrossChainIdentity(_crossChainIdentity);
        _setupRole(DEFAULT_ADMIN_ROLE, msg.sender);
        _setupRole(ADMIN_ROLE, msg.sender);
    }
    
    // 设置链桥地址
    function setBridgeAddress(uint256 chainId, address bridgeAddress) external onlyRole(ADMIN_ROLE) {
        bridgeAddresses[chainId] = bridgeAddress;
        emit BridgeAddressUpdated(chainId, bridgeAddress);
    }
    
    // 设置权限映射
    function setPermissionMapping(uint256 sourceChain, bytes32 sourcePermission, uint256 targetChain, bytes32 targetPermission) external onlyRole(ADMIN_ROLE) {
        permissionMappings[sourceChain][sourcePermission][targetChain] = targetPermission;
    }
    
    // 设置同步阈值
    function setSyncThreshold(uint256 threshold) external onlyRole(ADMIN_ROLE) {
        syncThreshold = threshold;
    }
    
    // 授予跨链访问权限
    function grantCrossChainAccess(uint256 tokenId, uint256 chainId, bytes32 resourceId) external onlyRole(OPERATOR_ROLE) {
        require(crossChainIdentity._exists(tokenId), "Identity not found");
        require(crossChainIdentity.isLinkedToChain(tokenId, chainId), "Identity not linked to chain");
        
        crossChainAccess[tokenId][chainId][resourceId] = true;
        
        // 更新同步状态
        syncStatus[tokenId][chainId][resourceId] = SyncStatus({
            lastSyncTime: block.timestamp,
            isSynced: false,
            syncBlock: block.number
        });
        
        emit CrossChainAccessGranted(crossChainIdentity.ownerOf(tokenId), tokenId, chainId, resourceId);
        
        // 触发跨链同步（通常由链桥合约调用）
        _triggerCrossChainSync(tokenId, chainId, resourceId, true);
    }
    
    // 撤销跨链访问权限
    function revokeCrossChainAccess(uint256 tokenId, uint256 chainId, bytes32 resourceId) external onlyRole(OPERATOR_ROLE) {
        require(crossChainIdentity._exists(tokenId), "Identity not found");
        
        delete crossChainAccess[tokenId][chainId][resourceId];
        
        // 更新同步状态
        syncStatus[tokenId][chainId][resourceId] = SyncStatus({
            lastSyncTime: block.timestamp,
            isSynced: false,
            syncBlock: block.number
        });
        
        emit CrossChainAccessRevoked(crossChainIdentity.ownerOf(tokenId), tokenId, chainId, resourceId);
        
        // 触发跨链同步
        _triggerCrossChainSync(tokenId, chainId, resourceId, false);
    }
    
    // 验证跨链访问权限
    function verifyAccess(uint256 tokenId, uint256 chainId, bytes32 resourceId) external returns (bool) {
        require(crossChainIdentity._exists(tokenId), "Identity not found");
        require(msg.sender == crossChainIdentity.ownerOf(tokenId), "Not authorized");
        
        // 检查直接权限
        bool hasDirectAccess = crossChainAccess[tokenId][chainId][resourceId];
        
        // 检查权限是否在同步阈值内
        SyncStatus memory status = syncStatus[tokenId][chainId][resourceId];
        bool isRecentlySynced = block.timestamp - status.lastSyncTime <= syncThreshold;
        
        // 如果没有直接权限，检查映射权限
        bool hasMappedAccess = false;
        uint256 supportedChainCount = crossChainIdentity.getSupportedChainCount();
        
        for (uint i = 0; i < supportedChainCount; i++) {
            uint256 mappedChainId = crossChainIdentity.chainIds(i);
            bytes32 mappedResourceId = permissionMappings[mappedChainId][resourceId][chainId];
            
            if (mappedResourceId != bytes32(0) && crossChainAccess[tokenId][mappedChainId][mappedResourceId]) {
                hasMappedAccess = true;
                break;
            }
        }
        
        bool granted = hasDirectAccess || hasMappedAccess;
        emit AccessVerified(msg.sender, tokenId, resourceId, granted);
        
        return granted;
    }
    
    // 从其他链接收跨链权限更新
    function receiveCrossChainUpdate(uint256 tokenId, uint256 sourceChainId, bytes32 resourceId, bool granted) external {
        // 验证调用者是链桥地址
        require(msg.sender == bridgeAddresses[sourceChainId], "Unauthorized bridge");
        require(crossChainIdentity._exists(tokenId), "Identity not found");
        
        // 更新权限状态
        if (granted) {
            crossChainAccess[tokenId][sourceChainId][resourceId] = true;
        } else {
            delete crossChainAccess[tokenId][sourceChainId][resourceId];
        }
        
        // 更新同步状态为已同步
        syncStatus[tokenId][sourceChainId][resourceId] = SyncStatus({
            lastSyncTime: block.timestamp,
            isSynced: true,
            syncBlock: block.number
        });
        
        // 检查是否需要更新映射权限
        bytes32 mappedResourceId = permissionMappings[sourceChainId][resourceId][block.chainid];
        if (mappedResourceId != bytes32(0)) {
            if (granted) {
                crossChainAccess[tokenId][block.chainid][mappedResourceId] = true;
            } else {
                delete crossChainAccess[tokenId][block.chainid][mappedResourceId];
            }
            
            syncStatus[tokenId][block.chainid][mappedResourceId] = SyncStatus({
                lastSyncTime: block.timestamp,
                isSynced: true,
                syncBlock: block.number
            });
        }
    }
    
    // 触发跨链同步
    function _triggerCrossChainSync(uint256 tokenId, uint256 targetChainId, bytes32 resourceId, bool granted) internal {
        address bridgeAddress = bridgeAddresses[targetChainId];
        require(bridgeAddress != address(0), "Bridge address not set");
        
        // 在实际应用中，这里应该调用链桥合约的方法进行跨链消息传递
        // 由于跨链调用的复杂性，这里仅作为示例
        // IBridge(bridgeAddress).sendCrossChainMessage(targetChainId, _encodeAccessMessage(tokenId, resourceId, granted));
    }
    
    // 编码跨链消息
    function _encodeAccessMessage(uint256 tokenId, bytes32 resourceId, bool granted) internal pure returns (bytes memory) {
        return abi.encode(tokenId, resourceId, granted);
    }
    
    // 检查跨链访问权限
    function canAccess(uint256 tokenId, uint256 chainId, bytes32 resourceId) public view returns (bool) {
        // 直接检查权限
        if (crossChainAccess[tokenId][chainId][resourceId]) {
            return true;
        }
        
        // 检查权限映射
        uint256 supportedChainCount = crossChainIdentity.getSupportedChainCount();
        for (uint i = 0; i < supportedChainCount; i++) {
            uint256 mappedChainId = crossChainIdentity.chainIds(i);
            bytes32 mappedResourceId = permissionMappings[mappedChainId][resourceId][chainId];
            
            if (mappedResourceId != bytes32(0) && crossChainAccess[tokenId][mappedChainId][mappedResourceId]) {
                return true;
            }
        }
        
        return false;
    }
    
    // 获取同步状态
    function getSyncStatus(uint256 tokenId, uint256 chainId, bytes32 resourceId) external view returns (uint256 lastSyncTime, bool isSynced, uint256 syncBlock) {
        SyncStatus memory status = syncStatus[tokenId][chainId][resourceId];
        return (status.lastSyncTime, status.isSynced, status.syncBlock);
    }
}

// 链桥接口
interface IBridge {
    function sendCrossChainMessage(uint256 targetChainId, bytes calldata message) external;
    function receiveCrossChainMessage(uint256 sourceChainId, bytes calldata message) external;
}