Roles and Permissions
Last updated
Inviting members, assigning roles (permissions), and managing a workspace are configured in Re:Earth Dashboard, which is shared across all products. For details, see the Dashboard documentation (in preparation).
The role assigned in Dashboard determines what that member can do in Re:Earth CMS. There are four roles.
| Role | What the role can do in the CMS |
|---|---|
| Owner | Can perform every operation in the CMS. Only Owner can regenerate an API key |
| Maintainer | Can perform every operation in the CMS except regenerating an API key |
| Writer | Can create and delete projects, and create, edit, and delete models, schemas, and views. Cannot change project settings. Can create items, assets, requests, and comments, and can edit and delete the ones they created themselves |
| Reader | Can only view |
What each role can do
Section titled “What each role can do”The operations each role can perform in the CMS are as follows. ✓ means it can be done and ✕ means it cannot.
| Resource | Operation | Owner | Maintainer | Writer | Reader |
|---|---|---|---|---|---|
| Project | View | ✓ | ✓ | ✓ | ✓ |
| Project | Create | ✓ | ✓ | ✓ | ✕ |
| Project | Change settings | ✓ | ✓ | ✕ | ✕ |
| Project | Delete | ✓ | ✓ | ✓ | ✕ |
| Project | Create, edit, delete an API key | ✓ | ✓ | ✕ | ✕ |
| Project | Regenerate an API key | ✓ | ✕ | ✕ | ✕ |
| Model | View | ✓ | ✓ | ✓ | ✓ |
| Model | Create, edit, delete | ✓ | ✓ | ✓ | ✕ |
| Schema | View | ✓ | ✓ | ✓ | ✓ |
| Schema | Create, edit, delete | ✓ | ✓ | ✓ | ✕ |
| Item | View | ✓ | ✓ | ✓ | ✓ |
| Item | Create | ✓ | ✓ | ✓ | ✕ |
| Item | Edit, delete | ✓ | ✓ | Only items they created | ✕ |
| Item | Publish | ✓ | ✓ | ✓ | ✕ |
| Asset | View | ✓ | ✓ | ✓ | ✓ |
| Asset | Create | ✓ | ✓ | ✓ | ✕ |
| Asset | Edit, delete | ✓ | ✓ | Only assets they created | ✕ |
| View | View | ✓ | ✓ | ✓ | ✓ |
| View | Create, edit, delete | ✓ | ✓ | ✓ | ✕ |
| Request | View | ✓ | ✓ | ✓ | ✓ |
| Request | Create | ✓ | ✓ | ✓ | ✕ |
| Request | Edit, close | ✓ | ✓ | Only requests they created | ✕ |
| Request | Approve | ✓ | ✓ | ✕ | ✕ |
| Comment | View | ✓ | ✓ | ✓ | ✓ |
| Comment | Create | ✓ | ✓ | ✓ | ✕ |
| Comment | Edit, delete | ✓ | ✓ | Only comments they created | ✕ |
“Publish” in the table is a base permission. Whether an item can actually be published directly depends on the project’s request requirement. For a role where a request is required, publishing becomes creating a request instead. For details, see Request.
“Approve” in the table is also a base permission. A request can actually be approved by the person who is assigned as a reviewer for that request.
“Change settings” in the table covers changing the name, alias, description, license, and README, switching the visibility, and changing the posting settings in Public API settings.
Integration
Section titled “Integration”A member of any role can create an integration. Editing or deleting an integration, and regenerating its integration token, are limited to integrations that member created.
| Resource | Operation | Owner | Maintainer | Writer | Reader |
|---|---|---|---|---|---|
| Integration | Create | ✓ | ✓ | ✓ | ✓ |
| Integration | Edit, delete | Only integrations they created | Only integrations they created | Only integrations they created | Only integrations they created |
| Integration | Regenerate the integration token | Only integrations they created | Only integrations they created | Only integrations they created | Only integrations they created |
| Integration | Connect to the workspace, change the role, disconnect | ✓ | ✓ | ✕ | ✕ |
| Integration | View the list of integrations connected to the workspace | ✓ | ✓ | ✓ | ✓ |
The steps to create and connect one are in Creating an Integration.