The building blocks
- A permission is one thing a person may do, such as listing orders or creating a role. Permissions are provided by Exowpee. You cannot create, edit or delete them.
- A role is a named set of permissions.
- A profile is a named set of roles, defined in one space.
- An assignment gives a person a profile. A person with several assignments works with one at a time, the one the session selected: see authentication.
- An extra permission is given directly to one member or agent account, for up to 5 permissions, optionally until a date. It adds to the profile: see Grant individual extra permissions.
orders.approve follows {group}.{action}, with actions such as list, retrieve, create, update and delete, and some groups have their own, such as approve. List available permissions returns the permissions of the space you work in. Each space has its own list, for example List available client permissions.
Built-in profiles and roles
Every new company, organization and client account starts with two built-in profiles,administrator and read only, and their roles of the same name. read only holds the permissions to list and view. Built-in roles and profiles cannot be edited or deleted. Everything else, roles and profiles alike, is built by the space itself with Create a role and Create a company profile.
How a call is decided
A call passes these checks in order. The first refusal ends it.- Token, space and kind of account. The token must be valid, and each token is bound to its kind of account. Each route accepts certain spaces and certain kinds of account: a company route refuses a client or organization session, and a route for people refuses agent accounts. Otherwise 401.
- Session key. The session key inside the token must still be the stored one. Otherwise 401.
- Active account. The account, its profile assignment, its membership and the owner (company, client account or organization) must be active. Otherwise 401. A person with no profile selected can only reach the routes made for that case, such as the account page and the profile switch; the others answer 403.
- Verified email, for people. Otherwise 401 with
email_not_verified. - Permission. The selected profile must hold the permission, through one of its roles or as an extra permission. Permissions are looked up in the space of the session, so the same person can hold different permissions in two companies. Otherwise 403.
- Working hours. When working hours are set on the assignment, the agent account or the company, the call must fall inside them. Hours are read in the company time zone, or in UTC when the space has none, as for a client account. Otherwise 403.
Some actions are not permission-driven
Some actions are authorized by who the caller is rather than by a permission. For example, in sales, creating an order or confirming a sale depends on the caller being a seller or a cashier. View my account tells you withis_seller and is_cashier. A permission list does not show these abilities. See Sellers and cashiers.
Reading the permissions of the session
- List my permissions: the permissions of the current profile plus the extra permissions of the person, one per permission group. It is empty when no profile is selected and no extra permission exists.
- List my company permissions: the permissions the company itself holds through its own roles, whoever is signed in. It is what the company may use, not what a person may do.
Where to go next
- Build roles and profiles: Define access profiles and roles.
- Give a profile to someone: Assign access to people.
- Limit where a person can work: Limit access to locations and books.
- A full example from invitation to first day: Give access to a new employee.