AccessController.sol

This contract is used to control access permissions for different function calls in the protocol.
It allows setting permissions for specific function calls, checking permissions, and initializing the contract.
The contract uses a mapping to store policies, which are represented as a nested mapping structure.
The contract also interacts with other contracts such as IIPAccountRegistry, IModuleRegistry, and IIPAccount.

Each policy is represented as a mapping from an IP account address to a signer address to a recipient
address to a function selector to a permission level.
The permission level can be 0 (ABSTAIN), 1 (ALLOW), or 2 (DENY).

The contract includes the following functions:

• initialize: Sets the addresses of the IP account registry and the module registry.
• setPermission: Sets the permission for a specific function call.
• getPermission: Returns the permission level for a specific function call.
• checkPermission: Checks if a specific function call is allowed._

IP_ACCOUNT_REGISTRY

address IP_ACCOUNT_REGISTRY

MODULE_REGISTRY

address MODULE_REGISTRY

encodedPermissions

mapping(bytes32 => uint8) encodedPermissions

Tracks the permission granted to an encoded permission path, where the
encoded permission path = keccak256(abi.encodePacked(ipAccount, signer, to, func))

constructor

constructor(address governance) public

initialize

function initialize(address ipAccountRegistry, address moduleRegistry) external

Initialize the Access Controller with the IP Account Registry and Module Registry addresses.
These are separated from the constructor, because we need to deploy the AccessController first for
to deploy many registry and module contracts, including the IP Account Registry and Module Registry.
Enforced to be only callable by the protocol admin in governance.

Parameters

setBatchPermissions

function setBatchPermissions(struct AccessPermission.Permission[] permissions) external

Sets a batch of permissions in a single transaction.

This function allows setting multiple permissions at once. Pausable.

Parameters

setGlobalPermission

function setGlobalPermission(address signer, address to, bytes4 func, uint8 permission) external

Sets the permission for all IPAccounts

Enforced to be only callable by the protocol admin in governance.

Parameters

setPermission

function setPermission(address ipAccount, address signer, address to, bytes4 func, uint8 permission) public

Sets the permission for a specific function call

Each policy is represented as a mapping from an IP account address to a signer address to a recipient
address to a function selector to a permission level. The permission level can be 0 (ABSTAIN), 1 (ALLOW), or
2 (DENY).
By default, all policies are set to 0 (ABSTAIN), which means that the permission is not set.
The owner of ipAccount by default has all permission.
address(0) => wildcard
bytes4(0) => wildcard
Specific permission overrides wildcard permission.

Parameters

checkPermission

function checkPermission(address ipAccount, address signer, address to, bytes4 func) external view

Checks the permission level for a specific function call. Reverts if permission is not granted.
Otherwise, the function is a noop.

This function checks the permission level for a specific function call.
If a specific permission is set, it overrides the general (wildcard) permission.
If the current level permission is ABSTAIN, the final permission is determined by the upper level.

Parameters

getPermission

function getPermission(address ipAccount, address signer, address to, bytes4 func) public view returns (uint8)

Returns the permission level for a specific function call.

Parameters

Return Values

_setPermission

function _setPermission(address ipAccount, address signer, address to, bytes4 func, uint8 permission) internal

The permission parameters will be encoded into bytes32 as key in the permissions mapping to save storage

_encodePermission

function _encodePermission(address ipAccount, address signer, address to, bytes4 func) internal view returns (bytes32)

encode permission to hash (bytes32)