Tej strony nie ma jeszcze w Twoim języku. Czytasz tekst angielski.
Knowledge base
Decide who sees which profiles
Two different questions
The role answers what a person may do: touch billing, change the shared pool, work only with what they were given. It is the same answer everywhere in the workspace.
Folders answer something narrower: out of the profiles opened to this person, which ones are visible. One person can be a manager and still see two folders out of ten.
Put profiles into folders
Folders live on the Groups tab and are shared across the whole workspace, so a folder means the same thing to everyone in it. The program offers the controls that create and change them to an owner or an admin.
Deleting a folder keeps its profiles: they move to the pile with no folder.
Open folders to a person
The choice belongs to the member's row, because that is where you already are when you think about it.
- 1
Open the team screen
The Team tab in the left column.
- 2
Find the person
The list of members on that tab.
- 3
Press Folders
The button in that person's row.
- 4
Tick the folders
The list inside the Folders window.
- 5
Press Save
The button at the bottom of that window.
An empty choice means everything
Ticking nothing is not the same as taking everything away. An empty list is read as no restriction, so removing the last folder gives the person the ordinary view back.
The opposite reading would be a trap: the way to widen access would look exactly like the way to cut it off.
A profile with no folder is hidden
The rule is read twice
It is read when the list of profiles is built and again when a profile is opened by its own identifier, and the same check now guards its extensions. A rule read in only one of those would be decoration: the other doors would still be open.
A profile outside the allowed folders answers as if it were not there at all. A different answer would let someone count the profiles they are not allowed to see.
Who cannot be narrowed
The owner of the workspace sees everything and cannot be restricted, and a folder from somebody else's workspace cannot be granted.
The restriction belongs to the workspace rather than to the person, so it does not follow them out of the door into their next one.
What this does not do
- It does not share a profile. Folders narrow what a person sees out of what was already opened to them.
- It does not restrict the owner. Whoever created the workspace sees all of it.
- It does not hide a profile from its own owner. This decides what teammates see, not what you see.
Where this is decided
Each claim above is one place in the code and one stand.
- A granted folder narrows the list, a forbidden profile refuses to start, and extensions honour the same rule
- apps/server/test/group-access.js
- The screen says out loud that an empty choice means seeing everything
- apps/web/test/member-folders.js
- Setting folders for a member really runs from the program
- apps/desktop/test/доступ-команде-из-программы.js
- The rule is read where a profile is listed and where it is opened by identifier
- apps/server/src/profiles/profiles.service.ts
Questions
- I removed every tick and now they see more.
- That is the rule: an empty choice means no restriction. Leave at least one folder ticked to keep the view narrow.
- Why does a forbidden profile say it does not exist?
- Because a different answer would confirm that it does. The refusal is deliberately the same one you get for an identifier that was never real.
- Does a folder restriction survive a change of role?
- Yes. They are separate answers to separate questions, and changing one does not rewrite the other.
- Can a teammate widen their own folders?
- No. The request to change folder access is refused for anyone below an admin.
Try it on one folder
The free plan gives two profiles, with no time limit and no card.