feat: Proxy admin for ownable

contracts/core/interfaces/IDependentLock.sol

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: UNLICENSED
+// Copyright (C) 2024 Lens Labs. All Rights Reserved.
+pragma solidity ^0.8.26;
+
+interface IDependentLock {
+    /**
+     * @dev Returns true if locked for the given address, false if not.
+     */
+    function isLocked(address addr) external view returns (bool);
+}

contracts/core/upgradeability/DependentLock.sol

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: UNLICENSED
+// Copyright (C) 2024 Lens Labs. All Rights Reserved.
+pragma solidity ^0.8.26;
+
+import {IDependentLock} from "contracts/core/interfaces/IDependentLock.sol";
+import {Ownable} from "contracts/core/access/Ownable.sol";
+import {EventEmitterEarly} from "contracts/migration/EventEmitterEarly.sol";
+
+contract DependentLock is Ownable, IDependentLock, EventEmitterEarly {
+    event Lens_Lock_LockStatusSet(bool indexed locked);
+    event Lens_Lock_LockStatusSet(address indexed target, bool indexed locked);
+
+    bool internal _areAllAddressesUnlocked;
+    mapping(address => bool) internal _isAddressUnlocked;
+
+    constructor(address owner, bool locked) Ownable() {
+        _transferOwnership(owner);
+        _setLockStatus(locked);
+    }
+
+    function isLocked(address addr) external view override returns (bool) {
+        if (_areAllAddressesUnlocked) {
+            return false;
+        } else {
+            return !_isAddressUnlocked[addr];
+        }
+    }
+
+    function setLockStatus(bool locked) external onlyOwner {
+        _setLockStatus(locked);
+    }
+
+    // Only to unlock specific addresses before the global lock is released.
+    function setLockStatusForAddress(address target, bool locked) external onlyOwner {
+        _isAddressUnlocked[target] = !locked;
+        emit Lens_Lock_LockStatusSet(target, locked);
+    }
+
+    function _setLockStatus(bool locked) internal {
+        _areAllAddressesUnlocked = !locked;
+        emit Lens_Lock_LockStatusSet(locked);
+    }
+}

contracts/core/upgradeability/ProxyAdminForOwnable.sol

@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: UNLICENSED
+// Copyright (C) 2024 Lens Labs. All Rights Reserved.
+pragma solidity ^0.8.26;
+
+import {IDependentLock} from "contracts/core/interfaces/IDependentLock.sol";
+import {IOwnable} from "contracts/core/interfaces/IOwnable.sol";
+import {BeaconProxy} from "contracts/core/upgradeability/BeaconProxy.sol";
+import {CallLib} from "contracts/core/libraries/CallLib.sol";
+import {Errors} from "contracts/core/types/Errors.sol";
+
+contract ProxyAdminForOwnable {
+    using CallLib for address;
+
+    IDependentLock immutable LOCK;
+
+    constructor(address lock) {
+        LOCK = IDependentLock(lock);
+        LOCK.isLocked(address(this)); // Aims to verify the given address follows IDependentLock interface
+    }
+
+    function call(address to, uint256 value, bytes calldata data) external payable returns (bytes memory) {
+        bytes4 selector = bytes4(data);
+        if (LOCK.isLocked(to)) {
+            // While the Proxy Admin is locked it:
+            // - Cannot change Proxy Admin in the Proxy, only in the ProxyAdmin contract itself
+            require(selector != BeaconProxy.proxy__changeProxyAdmin.selector, Errors.Locked());
+            // - Cannot change the Beacon in the Proxy
+            require(selector != BeaconProxy.proxy__setBeacon.selector, Errors.Locked());
+            // - Cannot change the implementation in the Proxy
+            require(selector != BeaconProxy.proxy__setImplementation.selector, Errors.Locked());
+            // - Cannot trigger an upgrade in the Proxy
+            require(selector != BeaconProxy.proxy__triggerUpgradeToVersion.selector, Errors.Locked());
+            require(selector != BeaconProxy.proxy__triggerUpgrade.selector, Errors.Locked());
+            // - Cannot opt-out from auto-upgrade in the Proxy
+            require(selector != BeaconProxy.proxy__optOutFromAutoUpgrade.selector, Errors.Locked());
+            // - Cannot opt-in to auto-upgrade in the Proxy
+            require(selector != BeaconProxy.proxy__optInToAutoUpgrade.selector, Errors.Locked());
+        }
+        // Require the msg.sender to match the owner
+        require(msg.sender == IOwnable(to).owner(), Errors.InvalidMsgSender());
+        bytes memory returnData = to.handledsafecall(value, data);
+        // Require the owner to not be altered by the executed transaction
+        require(IOwnable(to).owner() == msg.sender, Errors.UnexpectedValue());
+        return returnData;
+    }
+}