Permissions (Roles)
User permission levels are defined in /config inside the permissions object. Here you can define a multi-level tier of user access levels.
Out-of-the box, Gravity includes master, owner, admin, user and developer roles.
The same permission object is included inside client/src/permissions.json. You must use both files as the React client runs independently to the server. You can also define different permissions for the client UI if you need to.
The permission is stored in the JWT, so you can verify user actions at the API level based on this permission.
The permission level is also stored in the UI context so you can show or hide features depending on the user's permission level.
You should only use the permission stored in the client context for visceral purposes and ALWAYS use the API to control access. Savvy users can modify this permission and reveal hidden UI features. Using the API will prohibit them from performing an action they do not have permission to do.
Below is a breakdown of what each user permission can do by default. You can custom this logic to suit your own requirements.
Each account can only have one owner but as many admins and users as you need.
- view all accounts and all users
- edit any account and any user
- view application logs
- view user feedback
- can edit billing details
- can close the account
- can invite users
- can promote a user to admin
- can demote an admin to user
- can edit admins and users
- can create, update and delete API keys
- can invite users
- can edit users
- can promote a user to admin
- can view/edit/delete data that they are permitted to
- everything a user can do plus update and delete API keys
Last modified 1yr ago