@varla/sdk 2.13.1 → 2.15.0

package/src/actions/rbac.ts

@@ -2,6 +2,8 @@
 
 import type { Address, Hex } from "viem";
 
+import { abis } from "../generated.js";
+
 // ---------------------------------------------------------------------------
 // Common signatures (DevEx)
 // ---------------------------------------------------------------------------
@@ -78,3 +80,111 @@ export async function assertCanCallImmediate(params: {
     throw new Error(`AccessManager.canCall denied or delayed (delay=${r.delay})`);
   }
 }
+
+// ---------------------------------------------------------------------------
+// VarlaAccessManager — mutating RBAC actions
+// ---------------------------------------------------------------------------
+
+/** Grant a role to an account. Requires ADMIN role (0). */
+export async function prepareGrantRole(params: {
+  publicClient: { simulateContract: (args: any) => Promise<any> };
+  accessManagerAddress: Address;
+  account: Address;
+  roleId: bigint;
+  grantee: Address;
+  executionDelay: number;
+}): Promise<any> {
+  return await params.publicClient.simulateContract({
+    address: params.accessManagerAddress,
+    abi: abis.VARLAACCESSMANAGER_ABI,
+    functionName: "grantRole",
+    args: [params.roleId, params.grantee, params.executionDelay],
+    account: params.account,
+  });
+}
+
+/** Revoke a role from an account. Requires ADMIN role (0). */
+export async function prepareRevokeRole(params: {
+  publicClient: { simulateContract: (args: any) => Promise<any> };
+  accessManagerAddress: Address;
+  account: Address;
+  roleId: bigint;
+  target: Address;
+}): Promise<any> {
+  return await params.publicClient.simulateContract({
+    address: params.accessManagerAddress,
+    abi: abis.VARLAACCESSMANAGER_ABI,
+    functionName: "revokeRole",
+    args: [params.roleId, params.target],
+    account: params.account,
+  });
+}
+
+/** Map function selectors on a target to a role. Requires ADMIN role (0). */
+export async function prepareSetTargetFunctionRole(params: {
+  publicClient: { simulateContract: (args: any) => Promise<any> };
+  accessManagerAddress: Address;
+  account: Address;
+  target: Address;
+  selectors: readonly Hex[];
+  roleId: bigint;
+}): Promise<any> {
+  return await params.publicClient.simulateContract({
+    address: params.accessManagerAddress,
+    abi: abis.VARLAACCESSMANAGER_ABI,
+    functionName: "setTargetFunctionRole",
+    args: [params.target, params.selectors, params.roleId],
+    account: params.account,
+  });
+}
+
+/** Close or open a target contract. When closed, all restricted calls revert. */
+export async function prepareSetTargetClosed(params: {
+  publicClient: { simulateContract: (args: any) => Promise<any> };
+  accessManagerAddress: Address;
+  account: Address;
+  target: Address;
+  closed: boolean;
+}): Promise<any> {
+  return await params.publicClient.simulateContract({
+    address: params.accessManagerAddress,
+    abi: abis.VARLAACCESSMANAGER_ABI,
+    functionName: "setTargetClosed",
+    args: [params.target, params.closed],
+    account: params.account,
+  });
+}
+
+/** Set the admin role for a given role (role hierarchy). */
+export async function prepareSetRoleAdmin(params: {
+  publicClient: { simulateContract: (args: any) => Promise<any> };
+  accessManagerAddress: Address;
+  account: Address;
+  roleId: bigint;
+  adminRoleId: bigint;
+}): Promise<any> {
+  return await params.publicClient.simulateContract({
+    address: params.accessManagerAddress,
+    abi: abis.VARLAACCESSMANAGER_ABI,
+    functionName: "setRoleAdmin",
+    args: [params.roleId, params.adminRoleId],
+    account: params.account,
+  });
+}
+
+/** Set the guardian role for a given role. */
+export async function prepareSetRoleGuardian(params: {
+  publicClient: { simulateContract: (args: any) => Promise<any> };
+  accessManagerAddress: Address;
+  account: Address;
+  roleId: bigint;
+  guardianRoleId: bigint;
+}): Promise<any> {
+  return await params.publicClient.simulateContract({
+    address: params.accessManagerAddress,
+    abi: abis.VARLAACCESSMANAGER_ABI,
+    functionName: "setRoleGuardian",
+    args: [params.roleId, params.guardianRoleId],
+    account: params.account,
+  });
+}