Access Control

use ephemeral_rollups_pinocchio::instruction::delegate_permission;
use pinocchio::AccountView;

pub fn process_delegate_permission(
    accounts: &[&AccountView],
    permission_program: &pinocchio::Address,
    authority_is_signer: bool,
    permissioned_account_is_signer: bool,
) -> pinocchio::ProgramResult {
    // Accounts: [payer, authority, permissioned_account, permission, system_program,
    //           owner_program, delegation_buffer, delegation_record, 
    //           delegation_metadata, delegation_program, validator (optional)]
    
    // Pass signer_seeds if permissioned_account is a PDA owned by your program
    delegate_permission(
        accounts,
        permission_program,
        authority_is_signer,
        permissioned_account_is_signer,
        signer_seeds, // Or None if permissioned_account is on-curve
    )?;
    
    Ok(())
}

import {
  createDelegatePermissionInstruction,
  PERMISSION_PROGRAM_ID,
} from "@magicblock-labs/ephemeral-rollups-sdk";
import { transaction, sendAndConfirmTransaction } from "@solana/kit";

// Delegate the permission to enable low-latency Ephemeral Rollup execution
// Either authority (with AUTHORITY_FLAG) or permissioned_account can authorize
const delegatePermissionIx = await createDelegatePermissionInstruction(
  {
    payer: payer.address,  // Pays for account creation
    authority: [payer.address, true],  // Authority signer (has AUTHORITY_FLAG)
    permissionedAccount: [permissionedAccount.address, false],  // or permissioned_account can sign
    ownerProgram: PERMISSION_PROGRAM_ID,
    validator,  // Validator that will execute the delegated state
  }
);

const tx = transaction([delegatePermissionIx]);
const signature = await sendAndConfirmTransaction(
  client,
  tx,
  [payer]
);
console.log("TX:", signature);

import {
  PERMISSION_PROGRAM_ID,
  createDelegatePermissionInstruction,
} from "@magicblock-labs/ephemeral-rollups-sdk";
import { Transaction, sendAndConfirmTransaction } from "@solana/web3.js";

// Delegate the permission to enable low-latency Ephemeral Rollup execution
// Either authority (with AUTHORITY_FLAG) or permissioned_account can authorize
const delegatePermissionIx = createDelegatePermissionInstruction({
  payer: payer.publicKey,  // Pays for account creation
  authority: [payer.publicKey, true],  // Authority signer (has AUTHORITY_FLAG)
  permissionedAccount: [permissionedAccount.publicKey, false],  // or permissioned_account can sign
  ownerProgram: PERMISSION_PROGRAM_ID,
  validator,  // Validator that will execute the delegated state
});

const tx = new Transaction().add(delegatePermissionIx);
const txSig = await sendAndConfirmTransaction(connection, tx, [payer]);
console.log("TX:", txSig);

use ephemeral_rollups_pinocchio::instruction::update_permission;
use ephemeral_rollups_pinocchio::types::{
    Member,
    MemberFlags,
    MembersArgs,
};
use pinocchio::AccountView;

// Update permission with new member flags
// Either authority or permissioned_account must sign based on AUTHORITY_FLAG
let mut new_flags = MemberFlags::new();
new_flags.set(MemberFlags::TX_LOGS);
new_flags.set(MemberFlags::TX_BALANCES);

let updated_member = Member {
    flags: new_flags,
    pubkey: user_address,
};

let members = vec![updated_member];
let members_args = MembersArgs {
    members: Some(&members),
};

// Prepare accounts: [authority, permissioned_account, permission]
let accounts: &[&AccountView] = &[
    &authority,
    &permissioned_account,
    &permission,
];

// Update the permission
// Setting members to None makes the permission public (temporarily visible)
// Pass signer_seeds if permissioned_account is a PDA owned by your program
update_permission(
    accounts,
    &permission_program_id,
    authority.is_signer(),
    permissioned_account.is_signer(),
    members_args,
    signer_seeds, // Or None if permissioned_account is on-curve
)?;

import {
  createUpdatePermissionInstruction,
  type Member,
} from "@magicblock-labs/ephemeral-rollups-sdk";
import { transaction, sendAndConfirmTransaction } from "@solana/kit";

// Update permission and modify members
// Either authority or permissioned_account must sign based on AUTHORITY_FLAG
const updatePermissionIx = await createUpdatePermissionInstruction(
  {
    authority: [payer.address, true],  // authority can sign if they have AUTHORITY_FLAG
    permissionedAccount: [permissionedAccount.address, false],  // or permissioned_account can sign
  },
  {
    // Setting members to empty array or None makes the permission public (temporarily visible)
    // This is useful for transitional states during delegation/undeligation
    members: [],
  }
);

const tx = transaction([updatePermissionIx]);
const signature = await sendAndConfirmTransaction(
  client,
  tx,
  [payer]
);
console.log("TX:", signature);

import { createUpdatePermissionInstruction } from "@magicblock-labs/ephemeral-rollups-sdk";
import { Transaction, sendAndConfirmTransaction } from "@solana/web3.js";

// Update permission and modify members
// Either authority or permissioned_account must sign based on AUTHORITY_FLAG
const updatePermissionIx = createUpdatePermissionInstruction(
  {
    authority: [payer.publicKey, true],  // authority can sign if they have AUTHORITY_FLAG
    permissionedAccount: [permissionedAccount.publicKey, false],  // or permissioned_account can sign
  },
  {
    // Setting members to empty array or None makes the permission public (temporarily visible)
    // This is useful for transitional states during delegation/undeligation
    members: [],
  }
);

const tx = new Transaction().add(updatePermissionIx);
const txSig = await sendAndConfirmTransaction(connection, tx, [payer]);
console.log("TX:", txSig);

import {
  verifyTeeRpcIntegrity,
  getAuthToken,
} from "@magicblock-labs/ephemeral-rollups-sdk";
import { Connection, Keypair } from "@solana/web3.js";
import * as nacl from "tweetnacl";

const teeUrl = "https://devnet-tee.magicblock.app";
const teeWsUrl = "wss://tee.magicblock.app";

// 1. Verify the integrity of TEE RPC
const isVerified = await verifyTeeRpcIntegrity(teeUrl);

// 2. Get AuthToken before making request to TEE
const authToken = await getAuthToken(
  teeUrl,
  userKeypair.publicKey,
  (message: Uint8Array) =>
    Promise.resolve(nacl.sign.detached(message, userKeypair.secretKey)),
);

// 3. Create connection with TEE
const teeUserUrl = `${teeUrl}?token=${authToken.token}`;
const teeUserWsUrl = `${teeWsUrl}?token=${authToken.token}`;

const connection = new Connection(teeUserUrl, {
  wsEndpoint: teeUserWsUrl,
});

use ephemeral_rollups_pinocchio::instruction::commit_and_undelegate_permission;
use pinocchio::AccountView;

pub fn process_commit_and_undelegate_permission(
    accounts: &[&AccountView],
    permission_program: &pinocchio::Address,
    authority_is_signer: bool,
    permissioned_account_is_signer: bool,
) -> pinocchio::ProgramResult {
    // Accounts: [authority, permissioned_account, permission, magic_program, magic_context]
    
    // Pass signer_seeds if permissioned_account is a PDA owned by your program
    commit_and_undelegate_permission(
        accounts,
        permission_program,
        authority_is_signer,
        permissioned_account_is_signer,
        signer_seeds, // Or None if permissioned_account is on-curve
    )?;

    Ok(())
}

import {
  createCommitAndUndelegatePermissionInstruction,
} from "@magicblock-labs/ephemeral-rollups-sdk";
import { transaction, sendAndConfirmTransaction } from "@solana/kit";

const commitAndUndelegatePermissionIx =
  await createCommitAndUndelegatePermissionInstruction({
    authority: [payer.address, true],
    permissionedAccount: [permissionedAccount.address, false],
  });

const tx = transaction([commitAndUndelegatePermissionIx]);
const signature = await sendAndConfirmTransaction(
  client,
  tx,
  [payer]
);
console.log("TX:", signature);

import { createCommitAndUndelegatePermissionInstruction } from "@magicblock-labs/ephemeral-rollups-sdk";
import { Transaction, sendAndConfirmTransaction } from "@solana/web3.js";

const commitAndUndelegatePermissionIx = 
  createCommitAndUndelegatePermissionInstruction({
    authority: [payer.publicKey, true],
    permissionedAccount: [permissionedAccount.publicKey, false],
  });

const tx = new Transaction().add(commitAndUndelegatePermissionIx);
const txSig = await sendAndConfirmTransaction(connection, tx, [payer]);
console.log("TX:", txSig);

use ephemeral_rollups_pinocchio::instruction::close_permission;
use pinocchio::AccountView;

pub fn process_close_permission(
    accounts: &[&AccountView],
    permission_program: &pinocchio::Address,
    authority_is_signer: bool,
    permissioned_account_is_signer: bool,
) -> pinocchio::ProgramResult {
    // Accounts: [payer, authority, permissioned_account, permission]
    // IMPORTANT: The permission must be undelegated to Solana first
    // If the permission is still delegated, this operation will fail
    
    // Pass signer_seeds if permissioned_account is a PDA owned by your program
    close_permission(
        accounts,
        permission_program,
        authority_is_signer,
        permissioned_account_is_signer,
        signer_seeds, // Or None if permissioned_account is on-curve
    )?;

    // The permission account lamports are transferred to the payer
    Ok(())
}

import {
  createClosePermissionInstruction,
} from "@magicblock-labs/ephemeral-rollups-sdk";
import { transaction, sendAndConfirmTransaction } from "@solana/kit";

// Close the permission account and reclaim lamports
// IMPORTANT: The permission must be undelegated to Solana first
// If delegated, call commit_and_undelegate before closing
const closePermissionIx = await createClosePermissionInstruction({
  payer: payer.address,  // Receives reclaimed lamports
  authority: [payer.address, true],  // Authority signer (has AUTHORITY_FLAG)
  permissionedAccount: [permissionedAccount.address, false],  // or permissioned_account can sign
});

const tx = transaction([closePermissionIx]);
const signature = await sendAndConfirmTransaction(
  client,
  tx,
  [payer]
);
console.log("TX:", signature);

import { createClosePermissionInstruction } from "@magicblock-labs/ephemeral-rollups-sdk";
import { Transaction, sendAndConfirmTransaction } from "@solana/web3.js";

// Close the permission account and reclaim lamports
// IMPORTANT: The permission must be undelegated to Solana first
// If delegated, call commit_and_undelegate before closing
const closePermissionIx = createClosePermissionInstruction({
  payer: payer.publicKey,  // Receives reclaimed lamports
  authority: [payer.publicKey, true],  // Authority signer (has AUTHORITY_FLAG)
  permissionedAccount: [permissionedAccount.publicKey, false],  // or permissioned_account can sign
});

const tx = new Transaction().add(closePermissionIx);
const txSig = await sendAndConfirmTransaction(connection, tx, [payer]);
console.log("TX:", txSig);