Skip to main content

AccessControlMod

Manage roles and permissions within a diamond

Key Features
  • All functions are internal for integration into custom facets.
  • Utilizes the diamond storage pattern for shared state management.
  • Compatible with ERC-2535 diamonds.
  • No external dependencies, promoting composability.
Module Usage

This module provides internal functions for use in your custom facets. Import it to access shared logic and storage.

Overview​

This module provides internal functions for managing role-based access control within a Compose diamond. Facets can import this module to grant, revoke, and check roles using shared diamond storage. This pattern ensures consistent permission management across all facets interacting with the same storage.

Storage​

AccessControlStorage​

Definition
struct AccessControlStorage {
  mapping(address account => mapping(bytes32 role => bool hasRole)) hasRole;
  mapping(bytes32 role => bytes32 adminRole) adminRole;
}

State Variables​

PropertyTypeDescription
STORAGE_POSITIONbytes32Diamond storage slot position for this module (Value: keccak256("compose.accesscontrol"))
DEFAULT_ADMIN_ROLEbytes32Default administrative role identifier (bytes32(0)) (Value: 0x00)

Functions​

getStorage​

Returns the storage for the AccessControl.

function getStorage() pure returns (AccessControlStorage storage _s);

Returns:

PropertyTypeDescription
_sAccessControlStorageThe storage for the AccessControl.

grantRole​

function to grant a role to an account.

function grantRole(bytes32 _role, address _account) returns (bool);

Parameters:

PropertyTypeDescription
_rolebytes32The role to grant.
_accountaddressThe account to grant the role to.

Returns:

PropertyTypeDescription
-boolTrue if the role was granted, false otherwise.

hasRole​

function to check if an account has a role.

function hasRole(bytes32 _role, address _account) view returns (bool);

Parameters:

PropertyTypeDescription
_rolebytes32The role to check.
_accountaddressThe account to check the role for.

Returns:

PropertyTypeDescription
-boolTrue if the account has the role, false otherwise.

requireRole​

function to check if an account has a required role. Reverts with AccessControlUnauthorizedAccount If the account does not have the role.

function requireRole(bytes32 _role, address _account) view;

Parameters:

PropertyTypeDescription
_rolebytes32The role to assert.
_accountaddressThe account to assert the role for.

revokeRole​

function to revoke a role from an account.

function revokeRole(bytes32 _role, address _account) returns (bool);

Parameters:

PropertyTypeDescription
_rolebytes32The role to revoke.
_accountaddressThe account to revoke the role from.

Returns:

PropertyTypeDescription
-boolTrue if the role was revoked, false otherwise.

setRoleAdmin​

function to set the admin role for a role.

function setRoleAdmin(bytes32 _role, bytes32 _adminRole) ;

Parameters:

PropertyTypeDescription
_rolebytes32The role to set the admin for.
_adminRolebytes32The admin role to set.

Events​

Errors​

Best Practices​

Best Practice
  • Call requireRole to enforce access control checks before executing sensitive functions.
  • Ensure that your facet's storage layout is compatible with AccessControlStorage to prevent collisions.
  • Handle the AccessControlUnauthorizedAccount error for predictable revert behavior.

Integration Notes​

Shared Storage

This module uses diamond storage at the STORAGE_POSITION defined by keccak256("compose.accesscontrol"). All state modifications and reads are performed against the AccessControlStorage struct within this shared storage slot. Changes made by any facet using this module are immediately visible to all other facets accessing the same storage position.

Was this helpful?
Last updated:
This site is powered by Netlify