Deze pagina is nog niet in uw taal. U leest de Engelse tekst.
Glossary
Role-based access control
Role-based access control is a rule that decides what a person may do by the rank they hold, not by who they are.
The ladder and what it opens
Ranks are ordered, and each one carries everything below it. The names are the ones the industry uses, and the boundaries are the ones the server actually applies.
Member and operator
Work the profiles opened to them, and both add to and remove from the shared creatives the whole team draws from. Folders, addresses and schedules are not theirs to change.
Manager
Plus the folders, the address library, saved flows, schedules and orders from the address store. Money and people are not theirs.
Admin
Plus the three things the server keeps for admins alone: the money, the invites and ranks, and the workspace history.
Owner
Everything, and the one rank that cannot be removed or narrowed by anybody else.
Rank is compared rather than matched
A route asks for a minimum rank and anything above it passes, so an admin never needs a second permission to do a manager job.
A role the server does not recognise lands below the lowest rung, which means a typo grants nothing instead of granting everything.
Where the line falls
| Action | Lowest rank that passes |
|---|---|
| Open and work a profile that was shared | Member |
| Create, rename and delete folders | Manager |
| Add, edit or delete an address in the shared library | Manager |
| Rotate the address of a shared mobile line | Manager |
| Pull the whole address library to a second machine | Manager |
| Save a flow or a schedule for everyone | Manager |
| Order traffic from the address store | Manager |
| Invite, remove or change a rank | Admin |
| Read the workspace history | Admin |
| Change the plan or the card | Admin |
A program key carries a rank too
A key belongs to a person, so it answers to that person's rank and to its own narrower list of things it may touch.
Both are read on the same request, and the narrower of the two wins. A read-only key on an admin account still reads only.
Roles and folders answer different questions
A rank answers what a person may change. A folder answers which profiles they can see and open at all.
The two multiply rather than replace each other, so a manager narrowed to one client still edits the library and still sees one client.
Often confused with
Signing in
A second step at the door proves who arrived. A rank decides what that person is allowed to touch once they are inside.
Scopes on a program key
A scope narrows one key. A rank belongs to the person and applies to every key they ever create.
Folder access
Folders narrow what a person can see. A rank narrows what they can change, and the two are set in different places.
What this does not do
- It does not let you write your own role. The ladder is fixed, and the only choice is which rung a person stands on.
- It does not vary by folder. Somebody cannot be an admin over one client and an operator over another, because the rank belongs to the whole space.
- It does not hand a profile over. A rank decides what may be changed; a profile still has to be shared with the person before they see it.
- It does not narrow the owner. Whoever created the space sees all of it, and an admin cannot lock them out of their own account.
Check it
Each boundary above is one line in a file you can open.
- The ladder, the numeric rank and the roles that can be assigned
- apps/server/src/common/roles/workspace-roles.ts
- The rank is resolved after sign-in and compared, and an unknown role scores nothing
- apps/server/src/common/roles/roles.guard.ts
- The lowest rank is turned down for the address library and for rotation
- apps/server/test/paid-access.js · apps/server/test/proxy-secret.js
- Folder access is read where profiles are listed and where one is opened
- apps/server/test/group-access.js
Questions
- Can a manager see the money?
- No. Billing and the workspace history start at admin, while the list of who is in the space and on which rung stays open to everyone inside it.
- What happens if a role name is unknown?
- It resolves below the lowest rung and satisfies nothing. That is deliberate: a broken name has to fail closed, not open.
- Does an API key get around a rank?
- No. The key is resolved to its owner, the owner's rank is compared as usual, and the scopes written on the key narrow it further.
- Why can an operator use an address but not edit it?
- Using one is needed to start a profile at all. Editing or rotating one changes what colleagues are working through right now.
- Can I stop somebody from deleting profiles?
- Sharing never grants it. A profile is deleted by whoever created it or by an admin, and anybody else is told there is no such profile.
Give each person the rung they need
Invite a colleague, put them on a rung, and narrow them to the folders that are theirs.