nils/papercrate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

readonly role

Browse Source
This commit is contained in:
nils
2025-11-05 14:10:57 +01:00
parent 480bc20ae7
commit a75281aa13
8 changed files with 91 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/capability_sets.md
+2 -1
View File
@@ -28,10 +28,11 @@ All capabilities live in the `ApiCapability` enum. The current list is:
## Default Sets
Provisioning (and the test harness) seed three system capability sets per tenant:
Provisioning (and the test harness) seed four system capability sets per tenant:
- `owner` — contains the full set above. Tenant owners, admin users, and freshly minted API tokens effectively get unrestricted access.
- `user` — the default interactive role: full document/tag/correspondent/profile access, but no capability-set or WebDAV write privileges.
- `readonly` — interactive but read-only: document/folder/tag/correspondent reads plus WebDAV downloads, but no modifying routes.
- `webdav` — contains only `webdav:read`. WebDAV backup scripts can bind to this set for read-only access.
System sets are flagged with `is_system = true` and cannot be modified or deleted via the API.