gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-09 02:12:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(rbac): make complete built-in RBAC available on Community (#1793)

Browse Source 
Open all five built-in global roles and stack/node scoped assignments
on Community. Remove paid fences from user role create/update, scoped
assignment CRUD, permission evaluation, and the Users settings UI.

Admiral continues to own extended audit governance, LDAP directory
integration, and other organizational assurance features. Built-in
scoped RBAC is no longer marketed or enforced as paid-only.
This commit is contained in:
Anso
2026-08-07 23:50:53 -04:00
committed by GitHub
parent e084ad424c
commit 5c52ae26eb
15 changed files with 126 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/security.mdx
+5 -7
View File
@@ -72,7 +72,7 @@ Every self-hosted instance includes the full security stack. Some advanced gover
## Tier availability
Every Sencho instance includes the foundational security stack. Advanced access-control and compliance features are available on paid tiers.
Every Sencho instance includes the foundational security stack. Organizational identity and extended audit governance features are available on paid tiers.
| Feature | Community | Admiral |
|---------|:---------:|:-------:|
@@ -86,15 +86,13 @@ Every Sencho instance includes the foundational security stack. Advanced access-
| Rate limiting (auth + API) | ✓ | ✓ |
| Node-to-node authentication | ✓ | ✓ |
| Vulnerability scanning (on-demand + post-deploy + scheduled) | ✓ | ✓ |
| Multi-user with RBAC (Admin, Viewer) | ✓ | ✓ |
| Built-in RBAC (five roles + scoped assignments) | ✓ | ✓ |
| Webhook signatures (HMAC-SHA256) | ✓ | ✓ |
| API tokens (scoped, expiring) | ✓ | ✓ |
| SBOM generation (SPDX, CycloneDX) | ✓ | ✓ |
| Recent-activity audit log (14-day window) | ✓ | ✓ |
| Scan policies (`block_on_deploy`) | ✓ | ✓ |
| SARIF export (admin) | ✓ | ✓ |
| Advanced RBAC (Deployer, Node Admin, Auditor) | | ✓ |
| Scoped permissions (per-stack, per-node) | | ✓ |
| Audit log export, anomaly detection, and extended retention | | ✓ |
## Password authentication
@@ -182,7 +180,7 @@ Webhooks are available on every tier. For setup and verification recipes, see [W
## Role-based access control
Sencho defines five roles with increasing levels of access. Admin and Viewer are available on every tier; Deployer, Node Admin, and Auditor require Admiral.
Sencho defines five built-in roles with increasing levels of access. All five roles and stack or node scoped assignments are available on every plan.
### Permission matrix
@@ -202,9 +200,9 @@ Sencho defines five roles with increasing levels of access. Admin and Viewer are
| API tokens | ✓ | | | | |
| Host console | ✓ | | | | |
On Admiral, you can create **scoped assignments** that grant a user elevated permissions on specific stacks or nodes without giving them broad access. For example, a Viewer can be promoted to Deployer on a single production stack.
You can create **scoped assignments** that grant a user elevated permissions on specific stacks or nodes without giving them broad access. For example, a Viewer can be promoted to Deployer on a single production stack. Scoped assignments are available on Community and Admiral.
Both tiers support unlimited accounts. Community uses the Admin and Viewer roles; Admiral adds the Deployer, Node Admin, and Auditor roles plus scoped permissions.
Both tiers support unlimited accounts and the same five built-in roles with additive stack and node scopes.
For user management and scoped permissions, see [RBAC & User Management](/features/rbac).
docs/reference/settings.mdx
+4 -4
View File
@@ -186,7 +186,7 @@ See [Licensing & Billing](/features/licensing) for the full walkthrough includin
## Users
<Note>
User management requires an admin role. Community supports unlimited accounts with the Admin and Viewer roles.
User management requires an admin role. Community supports unlimited accounts with the full built-in RBAC system (five roles and scoped assignments).
</Note>
**Scope:** Global
@@ -206,9 +206,9 @@ Create and manage user accounts with role-based access. The masthead publishes a
|------|------|-------------|
| **Admin** | Community | Full access to all features |
| **Viewer** | Community | Read-only access to stacks and nodes |
| **Deployer** | Admiral | Can view stacks and trigger deployments |
| **Node Admin** | Admiral | Full stack and node management, including node-scoped operational Settings |
| **Auditor** | Admiral | Read-only plus audit log access |
| **Deployer** | Community | Can view stacks and trigger deployments |
| **Node Admin** | Community | Full stack and node management, including node-scoped operational Settings |
| **Auditor** | Community | Read-only plus audit log access |
See [RBAC & User Management](/features/rbac) for details on what each role can access.