You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/stellar-contracts/accounts/authorization-flow.mdx
+35Lines changed: 35 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,6 +5,41 @@ title: Authorization Flow
5
5
Authorization in smart accounts is determined by matching the current context against the account's context rules. Rules are gathered, ordered by recency, and evaluated until one satisfies the requirements. If a matching rule is found, its policies (if any) are enforced. Otherwise, authorization fails.
6
6
7
7
## Detailed Flow
8
+
```mermaid
9
+
sequenceDiagram
10
+
participant User
11
+
participant SmartAccount
12
+
participant ContextRule
13
+
participant DelegateSigner
14
+
participant Verifier
15
+
participant Policy
16
+
17
+
User->>SmartAccount: Signatures
18
+
SmartAccount->>ContextRule: Match context<br/>(CallContract, Default, ...)
19
+
ContextRule->>ContextRule: Filter expired rules<br/>Sort newest first
20
+
21
+
loop Each rule until match
22
+
Note over ContextRule,DelegateSigner: Built-in authorization <br/>for delegate signers
When simulating this transaction, the following authorization entry is returned. Note that `"auth"` contains a single element and the delegated signer address (G-account) is not present at all:
@@ -376,9 +376,9 @@ graph LR
376
376
TC --> |"require_auth()"| SA1
377
377
SA1 --> |"verify()"| V
378
378
379
-
style V fill:#16D9AA1,stroke:#333,stroke-width:2px
In contrast to `Delegated` signers, constructing the auth entry for an `External` signer is straightforward:
@@ -501,7 +501,7 @@ The trait uses associated types to allow different verifiers to define their own
501
501
502
502
### Advantages of the Verifier Pattern
503
503
504
-
**No Setup Costs**: Once a verifier is deployed, new keys can be used immediately without any on-chain setup or deployment expenses. Users simply reference the verifier address and provide their public key when creating signers.
504
+
**No Setup Costs**: Once a verifier is deployed, new keys can be used immediately without any on-chain setup. Users simply reference the verifier address and provide their public key when creating signers.
505
505
506
506
**Cryptographic Flexibility**: The verifier pattern supports diverse cryptographic schemes from standard curves to emerging authentication methods like zero-knowledge proofs and email-based signing. Developers can implement custom verifiers for specialized cryptographic schemes.
Smart accounts in Soroban are contracts that manage the composition of authorization intents from multiple sources, such as policies and signing keys from different cryptographic curves. They enable flexible combinations and allow multiple authorization mechanisms to work together seamlessly.
7
+
Smart accounts are contracts that manage the composition of authorization intents coming from multiple sources, such as policies, signing keys from different cryptographic curves or other Soroban accounts. This lays the ground for flexible combinations where multiple authorization mechanisms work together seamlessly.
8
8
9
9
## Overview
10
10
11
-
The [accounts](https://github.com/OpenZeppelin/stellar-contracts/tree/main/packages/accounts) package provides a comprehensive smart account framework for Soroban, enabling flexible, programmable authorization. Instead of hard-coding signature checks, smart accounts organize authorization as a composition of context rules, signers, and policies.
11
+
The [accounts](https://github.com/OpenZeppelin/stellar-contracts/tree/main/packages/accounts) package provides a comprehensive smart account framework, enabling programmable authorization. Rather than hard-coding signature checks directly into the account contract, this framework organizes authorization as a composition of three core elements: context rules, signers, and policies.
12
12
13
-
Smart accounts in Soroban implement `CustomAccountInterface` and define authorization as data and behavior that can evolve over time. The framework is context-centric: it distinguishes who is allowed to act (signers), what they are allowed to do (scope), and how those permissions are enforced (policies).
13
+
To achieve this composability, smart accounts implement the `CustomAccountInterface` and define authorization as data and behavior that can evolve over time. The framework takes a context-centric approach, separating three distinct concerns: who is allowed to act (signers), what they are allowed to do (scope or context rules), and how those permissions are enforced (policies).
14
14
15
-
The framework externalizes some parts of the logic and state to separate contracts. Policies are external contracts that manage enforcement rules and can maintain their own state, while verifiers are external contracts that handle signature validation logic. This separation of concerns enables modularity and flexibility, and allows multiple smart accounts to share well-audited verification and policy logic. Protocol 23 improvements make this modular design practical, with substantially cheaper cross-contract calls enabling efficient composition of multiple external components.
15
+
This separation is made practical by externalizing parts of the logic and state to dedicated contracts. Specifically, policies are external contracts that enforce constraints and can maintain their own state, while verifiers are external contracts that handle signature validation logic. This modular architecture enables flexibility and allows multiple smart accounts to share well-audited verification and policy logic. The Protocol 23 improvements make this design efficient, with substantially cheaper cross-contract calls enabling practical composition of multiple external contracts.
16
16
17
17
## Core Components
18
18
@@ -22,13 +22,51 @@ The framework separates three distinct concerns:
22
22
-**Who** (Signers): Identifies the authorized entities
23
23
-**How** (Policies): Enforces business logic and constraints
style SA fill:#E8E8E8,stroke:#333,stroke-width:2px
51
+
style S1 fill:#6B9BD1
52
+
style S2 fill:#6B9BD1
53
+
style S3 fill:#F4D03F
54
+
style S4 fill:#A9DA9B
55
+
style S5 fill:#A9DA9B
56
+
```
57
+
25
58
### Context Rules
26
59
Context rules function like routing tables for authorization. For each context, they specify scope, lifetime, and the conditions (signers and policies) that must be satisfied before execution proceeds.
27
60
61
+
#### Examples
62
+
1. Subscription: A dapp public key (signer) can withdraw 100 USDC every month (policy) for one year (lifetime)
63
+
2. Deployment: 2-of-3 (policy) Ed25519 keys (signers) can deploy a new contract
64
+
3. Vote: 3-of-3 P256 keys (signers) can cast a vote at a specific voting contract
65
+
28
66
For detailed documentation, see [Context Rules](/stellar-contracts/accounts/context-rules).
29
67
30
68
### Signers and Verifiers
31
-
Signers define who can authorize operations. The framework supports both delegated signers (any Soroban address) and external signers that use specialized verifier contracts for signature validation. Verifiers are cryptographic oracles that validate signatures for external signers.
69
+
Signers define who can authorize operations. The framework supports both **delegated** signers (any Soroban address) and **external** signers that use specialized verifier contracts for signature validation. Verifiers can be seen as some sort of cryptographic oracles that validate signatures for external signers.
32
70
33
71
For detailed documentation, see [Signers and Verifiers](/stellar-contracts/accounts/signers-and-verifiers).
0 commit comments