Struct RoleBasedAccessControl 

pub struct RoleBasedAccessControl { /* private fields */ }

Role-based access control (RBAC) for account components.

Instead of having one account holding every privilege, privileges are split into named roles (for example MINTER, BURNER, PAUSER), and each procedure is guarded against the caller’s role membership. It allows role assignment with domain isolation to minimize the scope of damage from a compromised role.

Security considerations

Access control is based on the note sender (the account ID that created the note), which authenticates which account created a note but not the code that executed when it was created. It is meaningful only when every account registered as a role member enforces strong authentication. Registering a permissionless account (for example one using no_auth) as a role member provides no access restriction: anyone can make such an account emit a note with an arbitrary script root and that account’s ID as sender, defeating the sender check.

Administration model

Role administration is fully role-based. Every role has an effective admin role: its configured delegated admin when set, otherwise the built-in ADMIN role. Only members of a role’s effective admin role may grant, revoke, or re-point (set_role_admin) that role.

The component is seeded at construction with one or more members of the ADMIN role (see new / with_admins); this bootstraps administration. The ADMIN role administers itself, so ADMIN membership can be granted, revoked, and renounced through the standard API.

Role hierarchy and exclusive delegation

Every role may have its admin delegated to another role via set_role_admin. Accounts holding a role’s admin role are authorized to grant and revoke that role. For example, accounts holding MINTER_ADMIN can manage the MINTER role but have no authority over BURNER or PAUSER.

Delegation is exclusive: once a role’s admin is delegated to another role, the ADMIN role loses all authority over it (grant, revoke, and further set_role_admin are then gated on the delegated admin). This lets a sensitive role — say a token issuer — be placed exclusively under a dedicated admin role and kept out of reach of the general administrator. To hand authority back, the current delegated admin re-points the role (passing 0 reverts it to the ADMIN role).

This supports a fully decentralized configuration: seed ADMIN, populate each role’s dedicated admin role, delegate, and finally revoke or renounce the bootstrap ADMIN members so no single key retains authority over the whole graph.

The delegated admin of a role can itself be any role, including one that it admins. Circular relationships are possible but should be designed with care, since each role can then revoke the other. Note that revoking the last member of a role’s effective admin (including the last ADMIN member for undelegated roles) leaves that role unmanageable until a member of its effective admin role is restored — treat ADMIN renouncement with the same caution as ownership renouncement.

Role semantics

A role is considered to exist when it has at least one member. Granting the first member creates the role; revoking the last member removes it. As a consequence, set_role_admin(A, B) stores the admin relationship in storage but does not make role A exist until a member is granted. Once the last member of A is revoked, get_role_member_count(A) returns 0, though the admin configuration is retained and will apply the next time a member is granted.

Membership lookup

has_role procedure is the primary guard used by procedures that assert the caller’s role membership. get_role_member_count returns the number of accounts holding a role.

Role symbol format

A RoleSymbol encodes up to 12 uppercase ASCII characters with underscores into a single field element using the same packing as the token symbol type. Examples: MINTER, MINTER_ADMIN, PAUSER. The zero field element is reserved and cannot be used as a role symbol; attempting to do so panics with ERR_ROLE_SYMBOL_ZERO.

Usage

Guarding a procedure in MASM so that only members of MINTER can call it:

pub proc mint
    push.MINTER_ROLE_SYMBOL
    exec.::miden::standards::access::rbac::assert_sender_has_role
    # add mint logic
end

Implementations

impl RoleBasedAccessControl

pub const NAME: &'static str = "miden::standards::components::access::rbac"

pub const ADMIN_ROLE: &'static str = "ADMIN"

The built-in default admin role symbol. A role whose delegated admin is unset is administered by members of this role.

Keep in sync with the ADMIN_ROLE constant in asm/standards/access/rbac.masm.

pub fn admin_role() -> RoleSymbol

Returns the built-in default admin RoleSymbol.

pub const fn name() -> AccountComponentName

Returns the canonical AccountComponentName of this component.

pub fn code() -> &'static AccountComponentCode

Returns the AccountComponentCode of this component.

pub fn new(initial_admin: AccountId) -> RoleBasedAccessControl

Returns an RBAC component whose ADMIN role is seeded with the given initial_admin.

The initial admin bootstraps role administration: it can grant every role (including ADMIN), configure delegated admins, and later hand off or renounce its own ADMIN membership. Additional roles are populated at runtime via the grant_role, set_role_admin, etc. procedures exposed by the component.

pub fn with_admins( initial_admins: BTreeSet<AccountId>, ) -> RoleBasedAccessControl

Returns an RBAC component whose ADMIN role is seeded with the given initial_admins.

Passing an empty set produces a component with no initial administrator, which cannot manage any role until ADMIN membership is established by other means; prefer new unless that is intended.

pub fn role_config_slot() -> &'static StorageSlotName

Returns the storage slot name for the per-role config map.

pub fn role_membership_slot() -> &'static StorageSlotName

Returns the storage slot name for the per-role membership map.

pub fn role_config_slot_schema() -> (StorageSlotName, StorageSlotSchema)

Returns the schema entry for the per-role config map.

pub fn role_membership_slot_schema() -> (StorageSlotName, StorageSlotSchema)

Returns the schema entry for the per-role membership map.

pub fn component_metadata() -> AccountComponentMetadata

Returns the AccountComponentMetadata describing this component.

Trait Implementations

impl Clone for RoleBasedAccessControl

fn clone(&self) -> RoleBasedAccessControl

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RoleBasedAccessControl

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for RoleBasedAccessControl

impl From<RoleBasedAccessControl> for AccountComponent

fn from(rbac: RoleBasedAccessControl) -> AccountComponent

Converts to this type from the input type.

impl PartialEq for RoleBasedAccessControl

fn eq(&self, other: &RoleBasedAccessControl) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for RoleBasedAccessControl