Web3 & DApp Development Fundamentals · Aula

Controle de acesso

Ownable e funções

Controle de acesso é uma aula grátis de Web3 & DApp Development Fundamentals no CoddyKit. Esta é a aula 2 de 4. Você pode ler a aula completa abaixo gratuitamente — depois pratica ao vivo no navegador com um editor de código integrado e um tutor de IA 24/7. Faz parte do caminho de aprendizado de Web3 & DApp Development Fundamentals, e seu progresso é sincronizado entre a web e o app CoddyKit. O curso de Web3 & DApp Development Fundamentals inclui 4 aulas no total.

Partes desta aula ainda não foram traduzidas e aparecem em inglês.

Why Access Control

Many contract functions should only be callable by certain accounts — minting tokens, pausing the system, withdrawing funds. Access control enforces who can do what.

OpenZeppelin offers two main patterns: Ownable and AccessControl.

The Ownable Pattern

Ownable gives a contract a single privileged owner. Import and inherit it:

import "@openzeppelin/contracts/access/Ownable.sol";

contract Vault is Ownable {
    constructor() Ownable(msg.sender) {}
}

The deployer becomes the initial owner.

import "@openzeppelin/contracts/access/Ownable.sol";

contract Vault is Ownable {
    constructor() Ownable(msg.sender) {}
}

The onlyOwner Modifier

Restrict a function to the owner with the onlyOwner modifier:

function withdraw() public onlyOwner {
    payable(owner()).transfer(address(this).balance);
}

If anyone else calls it, the transaction reverts automatically.

function withdraw() public onlyOwner {
    payable(owner()).transfer(address(this).balance);
}

Transferring Ownership

Ownable lets you hand control to another address:

// Give ownership to a new account
vault.transferOwnership(newOwner);

// Or give it up forever
vault.renounceOwnership();

Renouncing makes onlyOwner functions permanently uncallable — use with care.

// Give ownership to a new account
vault.transferOwnership(newOwner);

// Or give it up forever
vault.renounceOwnership();

Limits of a Single Owner

One owner is simple but limiting:

No way to grant different permissions to different people.
A single key is a single point of failure.

For richer setups, use role-based access control.

The AccessControl Pattern

AccessControl supports many named roles. Inherit it and define your roles:

import "@openzeppelin/contracts/access/AccessControl.sol";

contract Token is AccessControl {
    bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");
}

Roles are identified by a hashed name.

import "@openzeppelin/contracts/access/AccessControl.sol";

contract Token is AccessControl {
    bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");
}

Granting Roles

The deployer typically gets the admin role and then grants others:

constructor() {
    _grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
    _grantRole(MINTER_ROLE, msg.sender);
}

The DEFAULT_ADMIN_ROLE can grant and revoke all other roles.

constructor() {
    _grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
    _grantRole(MINTER_ROLE, msg.sender);
}

The onlyRole Modifier

Restrict functions to holders of a role:

function mint(address to, uint256 amount)
    public onlyRole(MINTER_ROLE) {
    _mint(to, amount);
}

Only accounts granted MINTER_ROLE can mint; everyone else reverts.

function mint(address to, uint256 amount)
    public onlyRole(MINTER_ROLE) {
    _mint(to, amount);
}

Managing Roles at Runtime

Admins can grant and revoke roles after deployment:

token.grantRole(MINTER_ROLE, alice);
token.revokeRole(MINTER_ROLE, alice);

// Check membership
bool canMint = await token.hasRole(MINTER_ROLE, alice);

An account can even renounce its own role.

token.grantRole(MINTER_ROLE, alice);
token.revokeRole(MINTER_ROLE, alice);

// Check membership
bool canMint = await token.hasRole(MINTER_ROLE, alice);

Choosing a Pattern

Which to use?

Ownable — simple admin tasks, one trusted operator.
AccessControl — multiple roles, separation of duties, DAOs.

For production, consider giving the owner/admin role to a multisig rather than a single key.

Each Role Has an Admin

In AccessControl, every role has an admin role that controls who can grant or revoke it. By default that is DEFAULT_ADMIN_ROLE, but you can change it:

// Make MANAGER_ROLE the admin of MINTER_ROLE
_setRoleAdmin(MINTER_ROLE, MANAGER_ROLE);

This lets you build hierarchies of permissions.

// Make MANAGER_ROLE the admin of MINTER_ROLE
_setRoleAdmin(MINTER_ROLE, MANAGER_ROLE);

Quick Check

Test your understanding of access control.

Recap

You learned OpenZeppelin's access control patterns.

Ownable gives one owner; restrict with onlyOwner and transfer or renounce ownership.
AccessControl supports many roles identified by hashed names.
Grant the admin role at deploy; protect functions with onlyRole.
Admins grant/revoke roles at runtime; accounts can renounce roles.
Use Ownable for simple cases, AccessControl (ideally behind a multisig) for complex ones.

Perguntas Frequentes

A aula “Controle de acesso” é grátis?

Sim — o texto completo de “Controle de acesso” é grátis para ler aqui na web. Para praticá-la interativamente (um editor de código integrado e um tutor de IA 24/7) e desbloquear o restante do curso de Web3 & DApp Development Fundamentals, atualize para CoddyKit PRO. O curso de Web3 & DApp Development Fundamentals inclui 4 aulas no total.

O que vou aprender em “Controle de acesso”?

Ownable e funções Você pratica Web3 & DApp Development Fundamentals com código prático que executa diretamente no navegador, e um tutor de IA 24/7 responde suas dúvidas enquanto trabalha na aula.

Preciso ter experiência prévia para começar Web3 & DApp Development Fundamentals?

Nenhuma experiência prévia é necessária. Web3 & DApp Development Fundamentals no CoddyKit é estruturado para alunos iniciantes até avançados, então você pode começar aqui ou desde o início e aprender no seu ritmo. Esta é a aula 2 de 4.

Quanto tempo leva a aula “Controle de acesso”?

A maioria das aulas CoddyKit leva cerca de 5–10 minutos. Cada uma é compacta e interativa, então você faz progresso constante e retoma exatamente de onde parou entre web e app.

Posso escrever e executar código nesta aula de Web3 & DApp Development Fundamentals?

Sim. Cada aula de Web3 & DApp Development Fundamentals inclui um editor de código integrado, então você escreve e executa código real direto no navegador e recebe feedback de IA instantaneamente — nenhuma configuração local necessária.

Todas as aulas deste curso

← Voltar para Web3 & DApp Development Fundamentals