Struct AuthSingleSigAcl 

pub struct AuthSingleSigAcl { /* private fields */ }

An AccountComponent implementing a procedure-based Access Control List (ACL) using either the EcdsaK256Keccak or Rpo Falcon 512 signature scheme for authentication of transactions.

This component provides fine-grained authentication control based on three conditions:

1. Procedure-based authentication: Requires authentication when any of the specified trigger procedures are called during the transaction.
2. Output note authentication: Controls whether creating output notes requires authentication. Output notes are new notes created by the account and sent to other accounts (e.g., when transferring assets). When allow_unauthorized_output_notes is false, any transaction that creates output notes must be authenticated, ensuring account owners control when their account sends assets to other accounts.
3. Input note authentication: Controls whether consuming input notes requires authentication. Input notes are notes that were sent to this account by other accounts (e.g., incoming asset transfers). When allow_unauthorized_input_notes is false, any transaction that consumes input notes must be authenticated, ensuring account owners control when their account processes incoming notes.

Authentication Logic

Authentication is required if ANY of the following conditions are true:

• Any trigger procedure from the ACL was called
• Output notes were created AND allow_unauthorized_output_notes is false
• Input notes were consumed AND allow_unauthorized_input_notes is false

If none of these conditions are met, only the nonce is incremented without requiring a signature.

Use Cases

• Restrictive mode (allow_unauthorized_output_notes=false, allow_unauthorized_input_notes=false): All note operations require authentication, providing maximum security.
• Selective mode: Allow some note operations without authentication while protecting specific procedures, useful for accounts that need to process certain operations automatically.
• Procedure-only mode (allow_unauthorized_output_notes=true, allow_unauthorized_input_notes=true): Only specific procedures require authentication, allowing free note processing.

Storage Layout

• Self::public_key_slot: Public key
• Self::config_slot: [num_trigger_procs, allow_unauthorized_output_notes, allow_unauthorized_input_notes, 0]
• Self::trigger_procedure_roots_slot: A map with trigger procedure roots

Important Note on Procedure Detection

The procedure-based authentication relies on the was_procedure_called kernel function, which only returns true if the procedure in question called into a kernel account API that is restricted to the account context. Procedures that don’t interact with account state or kernel APIs may not be detected as “called” even if they were executed during the transaction. This is an important limitation to consider when designing trigger procedures for authentication.

This component supports all account types.

Implementations

impl AuthSingleSigAcl

pub const NAME: &'static str = "miden::auth::singlesig_acl"

The name of the component.

pub fn new( pub_key: PublicKeyCommitment, auth_scheme: AuthScheme, config: AuthSingleSigAclConfig, ) -> Result<AuthSingleSigAcl, AccountError>

Creates a new AuthSingleSigAcl component with the given public_key and configuration.

Panics

Panics if more than AccountCode::MAX_NUM_PROCEDURES procedures are specified.

pub fn public_key_slot() -> &'static StorageSlotName

Returns the StorageSlotName where the public key is stored.

pub fn scheme_id_slot() -> &'static StorageSlotName

Returns the StorageSlotName where the scheme ID is stored.

pub fn config_slot() -> &'static StorageSlotName

Returns the StorageSlotName where the component’s configuration is stored.

pub fn trigger_procedure_roots_slot() -> &'static StorageSlotName

Returns the StorageSlotName where the trigger procedure roots are stored.

pub fn public_key_slot_schema() -> (StorageSlotName, StorageSlotSchema)

Returns the storage slot schema for the public key slot.

pub fn config_slot_schema() -> (StorageSlotName, StorageSlotSchema)

Returns the storage slot schema for the configuration slot.

pub fn auth_scheme_slot_schema() -> (StorageSlotName, StorageSlotSchema)

pub fn trigger_procedure_roots_slot_schema() -> (StorageSlotName, StorageSlotSchema)

Returns the storage slot schema for the trigger procedure roots slot.

Trait Implementations

impl From<AuthSingleSigAcl> for AccountComponent

fn from(singlesig_acl: AuthSingleSigAcl) -> AccountComponent

Converts to this type from the input type.