RBAC

Role-Based Access Control package for Gno smart contracts.

Overview

RBAC system enabling dynamic role management with address-based authorization and two-step ownership transfer.

Features

• Dynamic role registration with address assignment
• Address-based authorization checks
• Two-step ownership transfer (Ownable2Step pattern)
• System role protection (cannot be removed)
• Runtime role address updates

Core API

 1// Create RBAC manager with an explicit owner address.
 2func NewRBACWithAddress(addr address) *RBAC
 3
 4// Role management
 5func (rb *RBAC) RegisterRole(roleName string, addr address) error
 6func (rb *RBAC) UpdateRoleAddress(roleName string, addr address) error
 7func (rb *RBAC) RemoveRole(roleName string) error
 8
 9// Authorization
10func (rb *RBAC) IsAuthorized(roleName string, addr address) bool
11
12// Role queries
13func (rb *RBAC) GetRoleAddress(roleName string) (address, error)
14func (rb *RBAC) GetAllRoleAddresses() map[string]address
15
16// Ownership management
17func (rb *RBAC) Owner() address
18func (rb *RBAC) PendingOwner() address
19func (rb *RBAC) TransferOwnershipBy(newOwner, caller address) error
20func (rb *RBAC) AcceptOwnershipBy(addr address) error
21func (rb *RBAC) DropOwnershipBy(addr address) error

Usage

 1// Create manager with owner
 2manager := rbac.NewRBACWithAddress(adminAddr)
 3
 4// Register role with address
 5err := manager.RegisterRole("editor", editorAddr)
 6if err != nil {
 7    // handle error
 8}
 9
10// Check authorization
11if manager.IsAuthorized("editor", callerAddr) {
12    // caller is authorized as editor
13}
14
15// Update role address
16err = manager.UpdateRoleAddress("editor", newEditorAddr)
17
18// Get role address
19addr, err := manager.GetRoleAddress("editor")

System Roles

Reserved system-role names cannot be removed after they are registered. A new RBAC manager starts with no role entries; register each system role explicitly with its address.

• admin, governance, devops
• pool, position, router, staker
• emission, launchpad, protocol_fee
• gov_staker, xgns, community_pool

Errors

Security

• Address-based role authorization
• Two-step ownership transfer prevents accidental transfers
• System roles protected from removal
• Role name validation (no empty/whitespace names)