アクセス制御

use ephemeral_rollups_sdk::access_control::{
    instructions::UpdateEphemeralPermissionCpi,
    structs::{
        EphemeralMembersArgs, Member,
        TX_LOGS_FLAG, TX_MESSAGE_FLAG, TX_BALANCES_FLAG,
    },
};

let seeds: &[&[u8]] = &[
    COUNTER_SEED,
    permissioned_account_authority.as_ref(),
    &[bump],
];

// When private, only listed members can read ER state via the TEE.
let members = if is_private {
    vec![Member {
        flags: TX_LOGS_FLAG | TX_MESSAGE_FLAG | TX_BALANCES_FLAG,
        pubkey: permissioned_account_authority,
    }]
} else {
    vec![]
};

UpdateEphemeralPermissionCpi {
    payer: &counter_account_info,
    permissioned_account: &counter_account_info,
    permission: &permission_account_info,
    vault: &ephemeral_vault_account_info,
    magic_program: &magic_program_account_info,
    permission_program: &permission_program_account_info,
    authority: &counter_account_info,
    authority_is_signer: false,   // PDA signs via the seeds above
    args: EphemeralMembersArgs { is_private, members },
}
.invoke_signed(&[seeds])?;

use ephemeral_rollups_pinocchio::acl::{
    EphemeralMembersArgs, Member, MemberFlags, UpdateEphemeralPermission,
};
use pinocchio::cpi::{Seed, Signer};

const PERMISSION_CPI_BUF: usize = 64;

let bump_seed = [bump];
let seeds_array: [Seed; 3] = [
    Seed::from(b"counter"),
    Seed::from(authority.address().as_ref()),
    Seed::from(&bump_seed),
];
let signer = Signer::from(&seeds_array);

// Read the on-chain Counter to grab `authority` — the sole "private" member.
let counter_authority = {
    let data = counter_account.try_borrow()?;
    Counter::load(&data)?.authority
};

let single_member = [Member {
    flags: MemberFlags::from_acl_flag_byte(
        MemberFlags::TX_LOGS | MemberFlags::TX_MESSAGE | MemberFlags::TX_BALANCES,
    ),
    pubkey: counter_authority,
}];
let members: &[Member] = if is_private { &single_member } else { &[] };

UpdateEphemeralPermission {
    payer: counter_account,
    permissioned_account: counter_account,
    permission,
    vault,
    magic_program,
    permission_program,
    authority: counter_account,
    authority_is_signer: false,   // PDA signs via the seeds above
    args: EphemeralMembersArgs { is_private, members },
}
.invoke_signed::<PERMISSION_CPI_BUF>(&[signer])?;

import {
  MAGIC_PROGRAM_ID,
  PERMISSION_PROGRAM_ID,
  EPHEMERAL_VAULT_ID,
} from "@magicblock-labs/ephemeral-rollups-sdk";
import { pipe, createTransactionMessage, appendTransactionMessageInstructions } from "@solana/kit";

// Toggle the `is_private` flag. Idempotent — the program rebuilds the member
// list every call so the authority never locks itself out.
const updateIx = await counterProgram.methods
  .setPrivacy(isPrivate)
  .accountsPartial({
    authority: tempKeypair.address,
    counter: counterPda,
    permission: permissionPda,
    permissionProgram: PERMISSION_PROGRAM_ID,
    ephemeralVault: EPHEMERAL_VAULT_ID,
    magicProgram: MAGIC_PROGRAM_ID,
  })
  .instruction();

const transactionMessage = pipe(
  createTransactionMessage({ version: 0 }),
  (tx) => appendTransactionMessageInstructions([updateIx], tx),
);
const sig = await ephemeralConnection.sendAndConfirmTransaction(
  transactionMessage,
  [tempKeypair],
  { commitment: "confirmed" },
);
console.log("set_privacy tx:", sig);

import {
  MAGIC_PROGRAM_ID,
  PERMISSION_PROGRAM_ID,
  EPHEMERAL_VAULT_ID,
} from "@magicblock-labs/ephemeral-rollups-sdk";
import { Transaction, sendAndConfirmTransaction } from "@solana/web3.js";

// Toggle the `is_private` flag. Idempotent — the program rebuilds the member
// list every call so the authority never locks itself out.
const updateIx = await counterProgram.methods
  .setPrivacy(isPrivate)
  .accountsPartial({
    authority: tempKeypair.publicKey,
    counter: counterPda,
    permission: permissionPda,
    permissionProgram: PERMISSION_PROGRAM_ID,
    ephemeralVault: EPHEMERAL_VAULT_ID,
    magicProgram: MAGIC_PROGRAM_ID,
  })
  .instruction();

const tx = new Transaction().add(updateIx);
const sig = await sendAndConfirmTransaction(ephemeralConnection, tx, [tempKeypair]);
console.log("set_privacy tx:", sig);

use ephemeral_rollups_sdk::access_control::instructions::CloseEphemeralPermissionCpi;

let seeds: &[&[u8]] = &[
    COUNTER_SEED,
    permissioned_account_authority.as_ref(),
    &[bump],
];

// Refunds the permission's rent to `payer` (the counter PDA).
CloseEphemeralPermissionCpi {
    payer: &counter_account_info,
    permissioned_account: &counter_account_info,
    permission: &permission_account_info,
    vault: &ephemeral_vault_account_info,
    magic_program: &magic_program_account_info,
    permission_program: &permission_program_account_info,
    authority: &counter_account_info,
    authority_is_signer: false,
}
.invoke_signed(&[seeds])?;

use ephemeral_rollups_pinocchio::acl::CloseEphemeralPermission;
use pinocchio::cpi::{Seed, Signer};

let bump_seed = [bump];
let seeds_array: [Seed; 3] = [
    Seed::from(b"counter"),
    Seed::from(authority.address().as_ref()),
    Seed::from(&bump_seed),
];
let signer = Signer::from(&seeds_array);

// Refunds the permission's rent to `payer` (the counter PDA).
CloseEphemeralPermission {
    payer: counter_account,
    permissioned_account: counter_account,
    permission,
    vault,
    magic_program,
    permission_program,
    authority: counter_account,
    authority_is_signer: false,
}
.invoke_signed(&[signer])?;

import {
  MAGIC_PROGRAM_ID,
  PERMISSION_PROGRAM_ID,
  EPHEMERAL_VAULT_ID,
} from "@magicblock-labs/ephemeral-rollups-sdk";
import { pipe, createTransactionMessage, appendTransactionMessageInstructions } from "@solana/kit";

// Refunds the permission's rent to the counter PDA.
const closeIx = await counterProgram.methods
  .closePermission()
  .accountsPartial({
    authority: tempKeypair.address,
    counter: counterPda,
    permission: permissionPda,
    permissionProgram: PERMISSION_PROGRAM_ID,
    ephemeralVault: EPHEMERAL_VAULT_ID,
    magicProgram: MAGIC_PROGRAM_ID,
  })
  .instruction();

const transactionMessage = pipe(
  createTransactionMessage({ version: 0 }),
  (tx) => appendTransactionMessageInstructions([closeIx], tx),
);
const sig = await ephemeralConnection.sendAndConfirmTransaction(
  transactionMessage,
  [tempKeypair],
  { commitment: "confirmed" },
);
console.log("close_permission tx:", sig);

import {
  MAGIC_PROGRAM_ID,
  PERMISSION_PROGRAM_ID,
  EPHEMERAL_VAULT_ID,
} from "@magicblock-labs/ephemeral-rollups-sdk";
import { Transaction, sendAndConfirmTransaction } from "@solana/web3.js";

// Refunds the permission's rent to the counter PDA.
const closeIx = await counterProgram.methods
  .closePermission()
  .accountsPartial({
    authority: tempKeypair.publicKey,
    counter: counterPda,
    permission: permissionPda,
    permissionProgram: PERMISSION_PROGRAM_ID,
    ephemeralVault: EPHEMERAL_VAULT_ID,
    magicProgram: MAGIC_PROGRAM_ID,
  })
  .instruction();

const tx = new Transaction().add(closeIx);
const sig = await sendAndConfirmTransaction(ephemeralConnection, tx, [tempKeypair]);
console.log("close_permission tx:", sig);