Role-based access #312

New Issue

MrUnknownDE · 2026-04-05T16:17:22+02:00

MrUnknownDE commented

2026-04-05 16:17:22 +02:00

Originally created by @wayneshn on 8/8/2025

The system is built on three concepts: Actions, Resources, and Policies.

Actions (What you can do): A defined list of operations in the system, formatted as service:operation. This creates a clear, auditable namespace.
- archive:search
- archive:export
- archive:readContent
- settings:read
- settings:update
- users:create
- users:read
- users:update
- users:delete
- roles:assign
Resources (What you can do it to): A way to scope actions. For Open Archiver, the resources are simple but can be powerful.
- archive/all (The entire email archive)
- archive/custodian/{custodianId} (Emails belonging to a specific person)
- system/settings
- system/users
Policies (The rules that connect Actions to Resources): A policy is a JSON object that grants or denies permissions. A Role is simply a collection of these policies.

Todos

IAM policies definition
Permission middleware
Settings for admins to CRUD roles and assign roles
Settings for admins to create users

*Originally created by @wayneshn on 8/8/2025* The system is built on three concepts: **Actions**, **Resources**, and **Policies**. 1. **Actions (What you can do):** A defined list of operations in the system, formatted as `service:operation`. This creates a clear, auditable namespace. - `archive:search` - `archive:export` - `archive:readContent` - `settings:read` - `settings:update` - `users:create` - `users:read` - `users:update` - `users:delete` - `roles:assign` 2. **Resources (What you can do it to):** A way to scope actions. For Open Archiver, the resources are simple but can be powerful. - `archive/all` (The entire email archive) - `archive/custodian/{custodianId}` (Emails belonging to a specific person) - `system/settings` - `system/users` 3. **Policies (The rules that connect Actions to Resources):** A policy is a JSON object that grants or denies permissions. A Role is simply a collection of these policies. ## Todos - [ ] IAM policies definition - [ ] Permission middleware - [ ] Settings for admins to CRUD roles and assign roles - [ ] Settings for admins to create users

MrUnknownDE closed this issue

2026-04-05 16:17:22 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/OpenArchiver#312