Kontrol Akses
Ownable dan Roles
Kontrol Akses adalah pelajaran Web3 & DApp Development Fundamentals gratis di CoddyKit. Ini adalah pelajaran 2 dari 4. Kamu bisa membaca pelajaran lengkapnya di bawah secara gratis — lalu praktikkan langsung di browser dengan editor kode bawaan dan tutor AI 24/7. Ini adalah bagian dari jalur belajar Web3 & DApp Development Fundamentals, dan progresmu tersinkronisasi di web dan aplikasi CoddyKit. Kursus Web3 & DApp Development Fundamentals mencakup 4 pelajaran total.
Bagian dari pelajaran ini belum diterjemahkan dan ditampilkan dalam bahasa Inggris.
Why Access Control
Many contract functions should only be callable by certain accounts — minting tokens, pausing the system, withdrawing funds. Access control enforces who can do what.
OpenZeppelin offers two main patterns: Ownable and AccessControl.
The Ownable Pattern
Ownable gives a contract a single privileged owner. Import and inherit it:
import "@openzeppelin/contracts/access/Ownable.sol";
contract Vault is Ownable {
constructor() Ownable(msg.sender) {}
}The deployer becomes the initial owner.
import "@openzeppelin/contracts/access/Ownable.sol";
contract Vault is Ownable {
constructor() Ownable(msg.sender) {}
}The onlyOwner Modifier
Restrict a function to the owner with the onlyOwner modifier:
function withdraw() public onlyOwner {
payable(owner()).transfer(address(this).balance);
}If anyone else calls it, the transaction reverts automatically.
function withdraw() public onlyOwner {
payable(owner()).transfer(address(this).balance);
}Transferring Ownership
Ownable lets you hand control to another address:
// Give ownership to a new account
vault.transferOwnership(newOwner);
// Or give it up forever
vault.renounceOwnership();Renouncing makes onlyOwner functions permanently uncallable — use with care.
// Give ownership to a new account
vault.transferOwnership(newOwner);
// Or give it up forever
vault.renounceOwnership();Limits of a Single Owner
One owner is simple but limiting:
- No way to grant different permissions to different people.
- A single key is a single point of failure.
For richer setups, use role-based access control.
The AccessControl Pattern
AccessControl supports many named roles. Inherit it and define your roles:
import "@openzeppelin/contracts/access/AccessControl.sol";
contract Token is AccessControl {
bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");
}Roles are identified by a hashed name.
import "@openzeppelin/contracts/access/AccessControl.sol";
contract Token is AccessControl {
bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");
}Granting Roles
The deployer typically gets the admin role and then grants others:
constructor() {
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(MINTER_ROLE, msg.sender);
}The DEFAULT_ADMIN_ROLE can grant and revoke all other roles.
constructor() {
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(MINTER_ROLE, msg.sender);
}The onlyRole Modifier
Restrict functions to holders of a role:
function mint(address to, uint256 amount)
public onlyRole(MINTER_ROLE) {
_mint(to, amount);
}Only accounts granted MINTER_ROLE can mint; everyone else reverts.
function mint(address to, uint256 amount)
public onlyRole(MINTER_ROLE) {
_mint(to, amount);
}Managing Roles at Runtime
Admins can grant and revoke roles after deployment:
token.grantRole(MINTER_ROLE, alice);
token.revokeRole(MINTER_ROLE, alice);
// Check membership
bool canMint = await token.hasRole(MINTER_ROLE, alice);An account can even renounce its own role.
token.grantRole(MINTER_ROLE, alice);
token.revokeRole(MINTER_ROLE, alice);
// Check membership
bool canMint = await token.hasRole(MINTER_ROLE, alice);Choosing a Pattern
Which to use?
- Ownable — simple admin tasks, one trusted operator.
- AccessControl — multiple roles, separation of duties, DAOs.
For production, consider giving the owner/admin role to a multisig rather than a single key.
Each Role Has an Admin
In AccessControl, every role has an admin role that controls who can grant or revoke it. By default that is DEFAULT_ADMIN_ROLE, but you can change it:
// Make MANAGER_ROLE the admin of MINTER_ROLE
_setRoleAdmin(MINTER_ROLE, MANAGER_ROLE);This lets you build hierarchies of permissions.
// Make MANAGER_ROLE the admin of MINTER_ROLE
_setRoleAdmin(MINTER_ROLE, MANAGER_ROLE);Quick Check
Test your understanding of access control.
Recap
You learned OpenZeppelin's access control patterns.
- Ownable gives one
owner; restrict withonlyOwnerand transfer or renounce ownership. - AccessControl supports many roles identified by hashed names.
- Grant the admin role at deploy; protect functions with
onlyRole. - Admins grant/revoke roles at runtime; accounts can renounce roles.
- Use Ownable for simple cases, AccessControl (ideally behind a multisig) for complex ones.
Pertanyaan yang Sering Diajukan
Apakah pelajaran “Kontrol Akses” gratis?
Ya — teks lengkap “Kontrol Akses” gratis dibaca di sini di web. Untuk praktiknya secara interaktif (editor kode bawaan dan tutor AI 24/7) dan buka sisa kursus Web3 & DApp Development Fundamentals, upgrade ke CoddyKit PRO. Kursus Web3 & DApp Development Fundamentals mencakup 4 pelajaran total.
Apa yang akan aku pelajari di “Kontrol Akses”?
Ownable dan Roles Kamu berlatih Web3 & DApp Development Fundamentals dengan kode praktik yang langsung kamu jalankan di browser, dan tutor AI 24/7 menjawab pertanyaanmu saat kamu mengerjakan pelajaran ini.
Apakah aku perlu pengalaman untuk memulai Web3 & DApp Development Fundamentals?
Tidak diperlukan pengalaman sebelumnya. Web3 & DApp Development Fundamentals di CoddyKit dirancang untuk pemula hingga pelajar tingkat lanjut, jadi kamu bisa memulai di sini atau dari awal dan belajar sesuai kecepatan kamu sendiri. Ini adalah pelajaran 2 dari 4.
Berapa lama pelajaran “Kontrol Akses” memakan waktu?
Sebagian besar pelajaran CoddyKit memakan waktu sekitar 5–10 menit. Setiap pelajaran ringkas dan interaktif, jadi kamu membuat kemajuan stabil dan melanjutkan dari tempat kamu tinggalkan di web dan aplikasi.
Bisakah aku menulis dan menjalankan kode dalam pelajaran Web3 & DApp Development Fundamentals ini?
Ya. Setiap pelajaran Web3 & DApp Development Fundamentals menyertakan editor kode bawaan, jadi kamu menulis dan menjalankan kode nyata langsung di browser dan mendapatkan umpan balik AI instan — tidak diperlukan penyiapan lokal.