AdminAccessChecker

abstract contract AdminAccessChecker {
    IGlobalParams internal GLOBAL_PARAMS;
    
    error AdminAccessCheckerUnauthorized();
    
    function __AccessChecker_init(IGlobalParams globalParams) internal;
    modifier onlyProtocolAdmin();
    modifier onlyPlatformAdmin(bytes32 platformHash);
}

function __AccessChecker_init(IGlobalParams globalParams) internal;

modifier onlyProtocolAdmin();

function pauseCampaign() external onlyProtocolAdmin {
    // Only protocol admin can call
}

modifier onlyPlatformAdmin(bytes32 platformHash);

function updatePlatformSettings(bytes32 platformHash) 
    external 
    onlyPlatformAdmin(platformHash) 
{
    // Only that platform's admin can call
}

error AdminAccessCheckerUnauthorized();

contract MyContract is AdminAccessChecker {
    function initialize(IGlobalParams globalParams) external {
        __AccessChecker_init(globalParams);
    }
    
    function adminFunction() external onlyProtocolAdmin {
        // Only protocol admin can call
    }
    
    function platformFunction(bytes32 platformHash) 
        external 
        onlyPlatformAdmin(platformHash) 
    {
        // Only that platform's admin can call
    }
}

// Get protocol admin address
const protocolAdmin = await globalParams.getProtocolAdminAddress();
console.log('Protocol Admin:', protocolAdmin);

// Call protocol-admin-only function
try {
  await contract.protocolAdminFunction();
} catch (error) {
  if (error.message.includes('AdminAccessCheckerUnauthorized')) {
    console.log('Not authorized - only protocol admin can call');
  }
}

// Get platform admin address
const platformHash = ethers.utils.keccak256(
  ethers.utils.toUtf8Bytes('my-platform')
);
const platformAdmin = await globalParams.getPlatformAdminAddress(platformHash);
console.log('Platform Admin:', platformAdmin);

// Call platform-admin-only function
try {
  await contract.platformAdminFunction(platformHash);
} catch (error) {
  if (error.message.includes('AdminAccessCheckerUnauthorized')) {
    console.log('Not authorized - only platform admin can call');
  }
}

contract TreasuryFactory is AdminAccessChecker {
    constructor(IGlobalParams globalParams) {
        __AccessChecker_init(globalParams);
    }
    
    // Only protocol admin can approve implementations
    function approveTreasuryImplementation(...) 
        external 
        onlyProtocolAdmin 
    { ... }
    
    // Only platform admin can register implementations
    function registerTreasuryImplementation(...) 
        external 
        onlyPlatformAdmin(platformHash) 
    { ... }
}

// AdminAccessChecker queries GlobalParams for admin addresses
function _onlyProtocolAdmin() private view {
    address protocolAdmin = GLOBAL_PARAMS.getProtocolAdminAddress();
    if (msg.sender != protocolAdmin) {
        revert AdminAccessCheckerUnauthorized();
    }
}

function _onlyPlatformAdmin(bytes32 platformHash) private view {
    address platformAdmin = GLOBAL_PARAMS.getPlatformAdminAddress(platformHash);
    if (msg.sender != platformAdmin) {
        revert AdminAccessCheckerUnauthorized();
    }
}

// Use multi-sig for protocol admin
await globalParams.updateProtocolAdminAddress(multisigAddress);

// Use multi-sig for platform admins
await globalParams.updatePlatformAdminAddress(platformHash, multisigAddress);

// Always check authorization in frontend
try {
  await contract.protocolAdminFunction();
} catch (error) {
  if (error.message.includes('AdminAccessCheckerUnauthorized')) {
    showError('Only protocol admin can perform this action');
  }
}