Access Control Temporal Data Facet

Manages time-bound role assignments and checks for expired roles

Key Features

• Manages temporal role assignments and checks for expiry.
• Exposes getRoleExpiry, isRoleExpired, and requireValidRole for role validation.
• Operates on shared diamond storage via internal getStorage and getAccessControlStorage functions.
• Exports its selectors for diamond registration.

Overview

This facet provides functionality for managing time-bound access control roles within a Compose diamond. It exposes external view functions to check role expiry and internal functions to access its specific storage layout. This facet integrates with other access control facets by operating on shared diamond storage.

Storage

AccessControlStorage

Definition

struct AccessControlStorage {
  mapping(address account => mapping(bytes32 role => bool hasRole)) hasRole;
  mapping(bytes32 role => bytes32 adminRole) adminRole;
}

---

AccessControlTemporalStorage

Definition

struct AccessControlTemporalStorage {
  mapping(address account => mapping(bytes32 role => uint256 expiryTimestamp)) roleExpiry;
}

State Variables

Property	Type	Description
ACCESS_CONTROL_STORAGE_POSITION	bytes32	Diamond storage slot position for this module (Value: keccak256("compose.accesscontrol"))
TEMPORAL_STORAGE_POSITION	bytes32	Diamond storage slot position for this module (Value: keccak256("compose.accesscontrol.temporal"))

Functions

getRoleExpiry

Returns the expiry timestamp for a role assignment.

function getRoleExpiry(bytes32 _role, address _account) external view returns (uint256);

Parameters:

Property	Type	Description
_role	bytes32	The role to check.
_account	address	The account to check.

Returns:

Property	Type	Description
-	uint256	The expiry timestamp, or 0 if no expiry is set.

---

isRoleExpired

Checks if a role assignment has expired.

function isRoleExpired(bytes32 _role, address _account) external view returns (bool);

Parameters:

Property	Type	Description
_role	bytes32	The role to check.
_account	address	The account to check.

Returns:

Property	Type	Description
-	bool	True if the role has expired or doesn't exist, false if still valid.

---

requireValidRole

Checks if an account has a valid (non-expired) role. - Reverts with AccessControlUnauthorizedAccount If the account does not have the role. - Reverts with AccessControlRoleExpired If the role has expired.

function requireValidRole(bytes32 _role, address _account) external view;

Parameters:

Property	Type	Description
_role	bytes32	The role to check.
_account	address	The account to check the role for.

---

exportSelectors

Exports the selectors that are exposed by the facet.

function exportSelectors() external pure returns (bytes memory);

Returns:

Property	Type	Description
-	bytes	Selectors that are exported by the facet.

Events

Event emitted when a role is granted with an expiry timestamp.

Signature:

event RoleGrantedWithExpiry(
  bytes32 indexed _role, address indexed _account, uint256 _expiresAt, address indexed _sender
);

Parameters:

Property	Type	Description
_role	bytes32	The role that was granted.
_account	address	The account that was granted the role.
_expiresAt	uint256	The timestamp when the role expires.
_sender	address	The account that granted the role.

Event emitted when a temporal role is revoked.

Signature:

event TemporalRoleRevoked(bytes32 indexed _role, address indexed _account, address indexed _sender);

Parameters:

Property	Type	Description
_role	bytes32	The role that was revoked.
_account	address	The account from which the role was revoked.
_sender	address	The account that revoked the role.

Errors

Thrown when the account does not have a specific role.

Signature:

error AccessControlUnauthorizedAccount(address _account, bytes32 _role);

Thrown when a role has expired.

Signature:

error AccessControlRoleExpired(bytes32 _role, address _account);

Best Practices

Best Practice

• Ensure the AccessControlTemporalDataFacet is correctly initialized with its storage slot.
• When granting roles with expiry, ensure the _expiresAt timestamp is set appropriately.
• Verify that requireValidRole is called before sensitive operations that depend on time-bound roles.

Security Considerations

Security

This facet exposes requireValidRole, which reverts with AccessControlUnauthorizedAccount if the account lacks the role, or AccessControlRoleExpired if the role has expired. Input validation for role names and account addresses is handled by the underlying logic. No reentrancy concerns are present as all exposed functions are view or pure.

Was this helpful?

Last updated:March 13, 2026