Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
86 changes: 3 additions & 83 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -134,91 +134,11 @@ Documentation of all methods provided by the derived implementation of `Upgradab

Enables role-based access control for contract methods. A method with restricted access can only be called _successfully_ by accounts that have been granted one of the whitelisted roles. If a restricted method is called by an account with insufficient permissions, it panics.

Each role is managed by admins who may grant the role to accounts and revoke it from them. In addition, there are super admins that have admin permissions for every role.
Each role is managed by admins who may grant the role to accounts and revoke it from them. In addition, there are super admins that have admin permissions for every role. The sets of accounts that are (super) admins and grantees are stored in the contract's state.

The sets of accounts that are (super) admins and grantees are stored in the contract's state.
[This contract](/near-plugins/tests/contracts/access_controllable/src/lib.rs) provides an example of using `AccessControllable`. It is compiled, deployed on chain and interacted with in [integration tests](/near-plugins/tests/access_controllable.rs).

```rust
/// Roles are represented by enum variants.
///
/// Deriving `AccessControlRole` ensures `Role` can be used in
/// `AccessControllable`.
#[derive(AccessControlRole, Deserialize, Serialize, Copy, Clone)]
#[serde(crate = "near_sdk::serde")]
pub enum Role {
SkipperByOne,
SkipperByAny,
Resetter,
}

#[access_control(role_type(Role))]
#[near_bindgen]
#[derive(BorshDeserialize, BorshSerialize, PanicOnDefault)]
pub struct Contract {
counter: u64,
}

#[near_bindgen]
impl Counter {
/// Setup access control in the constructor.
#[init]
pub fn new() -> Self {
let contract = Self {
counter: 0,
// Initialize `AccessControllable` plugin state.
__acl: Default::default(),
};

// Add the contract itself as super admin.
near_sdk::require!(
contract.acl_init_super_admin(near_sdk::env::predecessor_account_id()),
"Failed to initialize super admin",
);

// Specify an account to be added as admin for a specific role.
let skipper_by_one_admin_account_id: AccountId = "alice.near".parse().unwrap();

// Add an admin for `Role::SkipperByOne`. This is possible since the
// contract was just made a super admin.
let result = contract.acl_add_admin(
Role::SkipperByOne.into(),
skipper_by_one_admin_account_id,
);
near_sdk::require!(Some(true) == result, "Failed to add admin");

// Specify an account to be granted a specific role.
let skipper_by_any_grantee_account_id: AccountId = "bob.near".parse().unwrap();

// Grant a role. Also possible since the contract is super admin.
let result = contract.acl_grant_role(
Role::SkpperByAny.into(),
skipper_by_any_grantee_account_id,
);
near_sdk::require!(Some(true) == result, "Failed to grant role");
}

/// This method has no access control. Anyone can call it successfully.
pub fn increase(&mut self) {
self.counter += 1;
}

/// Only an account that was granted either `Role::SkipperByOne` or
/// `Role::SkipperByAny` may successfully call this method.
#[access_control_any(roles(Role::SkipperByOne, Role::SkipperByAny))]
pub fn skip_one(&mut self) {
self.counter += 2;
}

/// Only an account that was granted `Role:Resetter` may successfully call
/// this method.
#[access_control_any(roles(Role::Resetter))]
pub fn reset(&mut self) {
self.counter = 0;
}
}
```

The derived implementation of `AccessControllable` provides more methods that are documented in the [definition of the trait](/near-plugins/src/access_controllable.rs). More usage patterns are explained in [examples](/examples/access-controllable-examples/) and in [integration tests](/near-plugins/tests/access_controllable.rs).
Documentation of all methods provided by `AccessControllable` is available in the [definition of the trait](/near-plugins/src/access_controllable.rs).

## Internal Architecture

Expand Down
Loading