mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 20:00:08 +00:00
Anso
c261fbc327
Security fixes:
- Map deploy-only API tokens to deployer role (not admin)
- Add token versioning to invalidate sessions on password/role changes
- Reject deleted users immediately in auth middleware (no 24h JWT grace)
- Use DB role instead of JWT role so changes take effect instantly
- Block password setting on SSO-provisioned users
- Check proxy variant in scoped permission resolver
Cleanup and logging:
- Remove orphaned role assignments when stacks/nodes are deleted
- Add standard logging for login, user CRUD, role assignments, password changes
- Add diagnostic logging gated behind developer_mode setting
- Extract issueSessionCookie helper (DRY across 5 JWT signing sites)
Frontend:
- Replace Select with Combobox in UsersSection (design system compliance)
- Add strokeWidth={1.5} to Lucide icons
- Hide password fields for SSO-provisioned users
Testing:
- Add 42-test RBAC suite covering user CRUD, token versioning, scoped
assignments, permissions endpoint, password management, seat limits,
last-admin protection, and orphan cleanup
130 lines
6.6 KiB
Plaintext
130 lines
6.6 KiB
Plaintext
---
|
|
title: RBAC & User Management
|
|
description: Role-based access control for Sencho - manage admin, viewer, deployer, node admin, and auditor accounts with scoped permissions.
|
|
---
|
|
|
|
<Note>
|
|
Multi-user support requires a **Sencho Skipper** or **Admiral** license. Community Edition supports a single admin account only. Intermediate roles (Deployer, Node Admin, Auditor) and scoped permissions require **Admiral**.
|
|
</Note>
|
|
|
|
Sencho supports role-based access control with five distinct roles. **Admin** and **Viewer** are available on all paid tiers, while **Deployer**, **Node Admin**, and **Auditor** are exclusive to Admiral.
|
|
|
|
## Roles
|
|
|
|
| Role | Description | Tier |
|
|
|------|-------------|------|
|
|
| **Admin** | Full access to all features: deploy, edit, manage users, configure nodes, and system settings | Skipper+ |
|
|
| **Viewer** | Read-only access to dashboards, logs, stats, and file contents | Skipper+ |
|
|
| **Deployer** | Can deploy, restart, stop, and start stacks, but cannot edit compose files, delete stacks, or access system settings | Admiral |
|
|
| **Node Admin** | Full stack and node management within their scope, but no access to system settings, users, or license management | Admiral |
|
|
| **Auditor** | Read-only access like Viewer, plus access to the audit log | Admiral |
|
|
|
|
### Permission matrix
|
|
|
|
| Action | Admin | Node Admin | Deployer | Auditor | Viewer |
|
|
|--------|-------|------------|----------|---------|--------|
|
|
| View stacks, logs, stats | Yes | Yes | Yes | Yes | Yes |
|
|
| Deploy / restart / stop / start stacks | Yes | Yes | Yes | No | No |
|
|
| Edit compose and `.env` files | Yes | Yes | No | No | No |
|
|
| Create and delete stacks | Yes | Yes | No | No | No |
|
|
| View nodes | Yes | Yes | Yes | Yes | Yes |
|
|
| Add / edit / delete nodes | Yes | Yes | No | No | No |
|
|
| Audit log | Yes | No | No | Yes | No |
|
|
| System settings | Yes | No | No | No | No |
|
|
| User management | Yes | No | No | No | No |
|
|
| License management | Yes | No | No | No | No |
|
|
| Webhooks | Yes | No | No | No | No |
|
|
| API tokens | Yes | No | No | No | No |
|
|
| Host console | Yes | No | No | No | No |
|
|
|
|
## Managing users
|
|
|
|
Go to **Settings > Users** to view the user list. The table shows each user's username, role badge, creation date, and action buttons.
|
|
|
|
<Frame>
|
|
<img src="/images/rbac/users-list.png" alt="User Management showing the users table with username, role, and creation date" />
|
|
</Frame>
|
|
|
|
From the user table you can:
|
|
|
|
- **Edit** a user by clicking the pencil icon
|
|
- **Delete** a user by clicking the trash icon (with a confirmation dialog)
|
|
|
|
You cannot delete your own account. The delete button is disabled for the currently logged-in user.
|
|
|
|
### Creating a user
|
|
|
|
Click **Add User** to open the creation form.
|
|
|
|
<Frame>
|
|
<img src="/images/rbac/user-create-form.png" alt="New User form with Username, Role, Password, and Confirm Password fields" />
|
|
</Frame>
|
|
|
|
| Field | Description |
|
|
|-------|-------------|
|
|
| **Username** | At least 3 characters. Letters, numbers, underscores, and hyphens only. |
|
|
| **Role** | Select from the available roles (see below) |
|
|
| **Password** | At least 8 characters |
|
|
| **Confirm Password** | Must match the password field |
|
|
|
|
On Admiral, all five roles appear in the role selector. On Skipper, only Admin and Viewer are available.
|
|
|
|
<Frame>
|
|
<img src="/images/rbac/role-selector-dropdown.png" alt="Role selector dropdown showing all five roles on Admiral" />
|
|
</Frame>
|
|
|
|
### Editing a user
|
|
|
|
Click the pencil icon on a user row to edit. You can change the username, role, and optionally set a new password. Leave the password fields blank to keep the existing password.
|
|
|
|
## Scoped permissions
|
|
|
|
<Note>
|
|
Scoped permissions require an **Admiral** license.
|
|
</Note>
|
|
|
|
Roles can be scoped to specific stacks or nodes. This lets you grant a user elevated permissions on particular resources without giving them broad access.
|
|
|
|
Scoped permissions **add to** the user's global role. They never reduce it. A user with a global Viewer role plus a scoped Deployer assignment on the "my-app" stack can deploy "my-app" but has read-only access to everything else.
|
|
|
|
When editing a user on Admiral, a **Scoped Permissions** section appears below the user form. From there you can:
|
|
|
|
1. **View** the user's current scoped assignments, each showing the role badge, resource type, and resource name
|
|
2. **Add** a new scope by selecting a role (Deployer, Node Admin, or Admin), resource type (Stack or Node), and the specific resource
|
|
3. **Remove** an existing scope with the trash icon
|
|
|
|
### Example scenarios
|
|
|
|
- A **Viewer** with a scoped **Deployer** assignment on the `frontend` stack can deploy, restart, and stop only that stack.
|
|
- A **Deployer** with a scoped **Node Admin** assignment on node "staging-server" can manage stacks and nodes on that server, plus deploy globally.
|
|
- A **Node Admin** without any scoped assignments can manage all stacks and nodes but has no access to system settings.
|
|
|
|
## SSO auto-provisioning
|
|
|
|
With an Admiral license, users can also be created automatically when they log in via SSO (LDAP, Google, GitHub, or Okta). SSO users appear in the Users list alongside local accounts and are assigned a role based on identity provider group membership or claim mapping.
|
|
|
|
SSO users cannot log in with a password; they must always authenticate through their identity provider. After SSO provisioning, an admin can add scoped permissions to SSO users just like local accounts.
|
|
|
|
To set up identity provider authentication, see [SSO Authentication](/features/sso).
|
|
|
|
## Session security
|
|
|
|
Sencho enforces user changes immediately:
|
|
|
|
- **Account deletion**: A deleted user's active sessions are rejected on the next request. There is no delay or grace period.
|
|
- **Role changes**: When an admin changes a user's role, the new permissions take effect immediately for all of that user's active sessions.
|
|
- **Password changes**: Changing a password (either your own or as an admin reset) invalidates all other active sessions for that user. The session that performed the change remains valid.
|
|
- **SSO users**: Password fields are hidden for SSO-provisioned users. SSO accounts always authenticate through their identity provider.
|
|
|
|
## Migration from single-admin setup
|
|
|
|
When you upgrade to a Skipper or Admiral license, your existing single-admin credentials are automatically migrated. No manual action is required; your login continues to work as before, and your account is assigned the Admin role.
|
|
|
|
## Account limits by tier
|
|
|
|
| Tier | Admin accounts | Non-admin accounts | Intermediate roles | Scoped permissions |
|
|
|------|---------------|-------------------|-------------------|-------------------|
|
|
| **Community** | 1 | 0 | No | No |
|
|
| **Skipper** | 1 | 3 | No | No |
|
|
| **Admiral** | Unlimited | Unlimited | Yes | Yes |
|