Access Control Temporal Grant Facet

Grants roles with time-based expiry

Key Features

• Grants roles with a specified expiry timestamp.
• Emits RoleGrantedWithExpiry event upon successful role granting.
• Reverts with AccessControlUnauthorizedAccount if the caller lacks permission.
• Reverts with AccessControlRoleExpired if the role has expired.

Overview

This facet manages role assignments with time-based expiry within a Compose diamond. It provides an external function to grant roles, ensuring they automatically expire. This facet interacts with shared diamond storage to manage role assignments, making role management upgradeable and composable.

Storage

AccessControlStorage

Definition

struct AccessControlStorage {
  mapping(address account => mapping(bytes32 role => bool hasRole)) hasRole;
  mapping(bytes32 role => bytes32 adminRole) adminRole;
}

---

AccessControlTemporalStorage

Definition

struct AccessControlTemporalStorage {
  mapping(address account => mapping(bytes32 role => uint256 expiryTimestamp)) roleExpiry;
}

State Variables

Property	Type	Description
ACCESS_CONTROL_STORAGE_POSITION	bytes32	Diamond storage slot position for this module (Value: keccak256("compose.accesscontrol"))
TEMPORAL_STORAGE_POSITION	bytes32	Diamond storage slot position for this module (Value: keccak256("compose.accesscontrol.temporal"))

Functions

grantRoleWithExpiry

Grants a role to an account with an expiry timestamp. Only the admin of the role can grant it with expiry. Emits a RoleGrantedWithExpiry event. Reverts with AccessControlUnauthorizedAccount If the caller is not the admin of the role.

function grantRoleWithExpiry(bytes32 _role, address _account, uint256 _expiresAt) external;

Parameters:

Property	Type	Description
_role	bytes32	The role to grant.
_account	address	The account to grant the role to.
_expiresAt	uint256	The timestamp when the role should expire (must be in the future).

---

exportSelectors

Exports the selectors that are exposed by the facet.

function exportSelectors() external pure returns (bytes memory);

Returns:

Property	Type	Description
-	bytes	Selectors that are exported by the facet.

Events

Event emitted when a role is granted with an expiry timestamp.

Signature:

event RoleGrantedWithExpiry(
  bytes32 indexed _role, address indexed _account, uint256 _expiresAt, address indexed _sender
);

Parameters:

Property	Type	Description
_role	bytes32	The role that was granted.
_account	address	The account that was granted the role.
_expiresAt	uint256	The timestamp when the role expires.
_sender	address	The account that granted the role.

Errors

Thrown when the account does not have a specific role.

Signature:

error AccessControlUnauthorizedAccount(address _account, bytes32 _role);

Thrown when a role has expired.

Signature:

error AccessControlRoleExpired(bytes32 _role, address _account);

Best Practices

Best Practice

• Initialize the diamond with necessary roles and accounts before using this facet.
• Ensure the caller has the administrative privilege for the role being granted.
• Verify role expiry logic by testing with accounts that have expired roles.

Security Considerations

Security

State-changing functions, specifically grantRoleWithExpiry, are protected by access control, ensuring only authorized accounts can grant roles. The function adheres to the checks-effects-interactions pattern. Input validation for the expiry timestamp should be considered to prevent granting roles with past expiry dates, although the AccessControlRoleExpired error implicitly handles this for role checks. The facet relies on the diamond's internal storage mechanism for role management.

Was this helpful?

Last updated:March 13, 2026