Introduction to Roles
Roles in Dew Finance are simple string identifiers that determine who can initiate or approve policy executions. Below are a few key points about roles:
- Roles are lightweight - they're just string identifiers that can be assigned to accounts
- Role assignment is managed through the
grant_roleandrevoke_rolepolicy - Multiple roles can be assigned to a single account, and multiple accounts can share the same role (many-to-many relationship)
- A role can be granted to a
RoleTargetwhich can either be:AccountId: Any specified NEAR account IDCodehash: A code hash derived from shade agent code, allowing any shade agent running that code to assume the role.
Role assignment
Role assignment in Dew Finance is managed through the grant_role policy, which allows authorized vault operators to assign roles to accounts or code hashes.
Granting a role to a code hash involves an additional step: after the code hash is assigned a role via the grant_role policy, any Shade agent running the approved code can register itself using the register_agent method. Once registered, the agent can participate in proposal submission and voting, similar to a regular account.
By default:
- The
ownerrole is created automatically when the vault is initialized. - The vault creator is assigned the
ownerrole by default. - All vault configuration policies initially require the
ownerrole, but these requirements can be updated for more granular permission management.
// other vault states
account_roles: IterableMap<RoleTarget, UnorderedSet<Role>>,
// other vault states
pub enum RoleTarget {
AccountId(AccountId),
Codehash(Codehash),
}