josh/electric-cherry
1
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases Wiki Activity

Add Super Viewer read-only administrator role
CI / checks (push) Successful in 5m40s
Details

Browse Source
This commit is contained in:
josh
2026-10-11 23:30:40 -04:00
parent 253d47300c
commit 4ea291d305
48 changed files with 1684 additions and 933 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/guides/authentication.md
+20 -13
View File
@@ -31,16 +31,23 @@ guessable token. An unset setup token holds setup closed.
## Roles
| Capability | Viewer | Operator | Administrator |
| --------------------------------------------------------------------------------------------- | -------------- | ----------- | ------------- |
| Fleet, metrics, matches and operation summaries | Yes | Yes | Yes |
| Raw configs, file diffs, logs, RCON and telemetry diagnostics | No | Yes | Yes |
| Deploy/start/stop/restart/rebuild/remove servers | No | Yes | Yes |
| Scripts, plugins, configs, campaigns, betas and collections | Read summaries | Manage | Manage |
| Host setup, deletion, enrollment, credentials, runtime preparation and game-file upload/cache | Read status | Read status | Manage |
| Server keys and global settings/maintenance policies | No | No | Manage |
| Create users, change roles, disable accounts and reset passwords | No | No | Yes |
| Own password and sign out | Yes | Yes | Yes |
| Capability | Viewer | Super Viewer | Operator | Administrator |
| --------------------------------------------------------------------------------------------- | -------------- | ------------ | ----------- | ------------- |
| Fleet, metrics, matches and operation summaries | Yes | Yes | Yes | Yes |
| Raw configs, file diffs, logs, saved RCON and telemetry diagnostics | No | Read | Read | Read |
| Deploy/start/stop/restart/rebuild/remove servers and run diagnostic probes | No | No | Yes | Yes |
| Scripts, plugins, configs, campaigns, betas and collections | Read summaries | Read | Manage | Manage |
| Host setup, deletion, enrollment, credentials, runtime preparation and game-file upload/cache | Read status | Read status | Read status | Manage |
| Server keys and global settings/maintenance policies | No | Read | No | Manage |
| Users and account audit activity | No | Read | No | Manage |
| Create users, change roles, disable accounts and reset passwords | No | No | No | Yes |
| Own password and sign out | Yes | Yes | Yes | Yes |
Super Viewer is a read-only administrator. It includes the Admin navigation and
access to sensitive configuration and diagnostic content, but cannot change fleet
state, settings, keys, or other accounts. Cleanup previews remain available because
they do not save settings or run cleanup. Assign it only to people trusted to read
administrative information. Existing accounts and sessions are preserved on upgrade.
Operators can launch using available game-pool keys already saved by an administrator. They
cannot save keys indirectly through a launch request. An operator's content
@@ -50,9 +57,9 @@ people trusted to operate the game fleet.
Drift previews (`/api/drift`) and GitHub release lookups
(`/api/plugins/github/release`) require operator or administrator access, including
`GET` and `HEAD` requests. These endpoints initiate fleet file scans or use GitHub
API quota; viewers cannot trigger them.
API quota; Viewers and Super Viewers cannot trigger them.
RCON failure replies are available only to operators and administrators in the
Saved RCON failure replies are available to Super Viewers, operators and administrators in the
server's Diagnostics tab. Player addresses are redacted before diagnostics are
saved; successful checks clear the saved reply. Fleet snapshots and live status
streams contain no reply snippets. Upgrades discard older saved RCON snippets.
@@ -79,7 +86,7 @@ revocation every 15 seconds and then close.
Login, initial setup and password verification are rate-limited with persistent
15-minute windows. The database stores audit entries for login results, account
changes and successful management requests without recording passwords, tokens
or request bodies. Administrators can review recent entries in Users.
or request bodies. Administrators and Super Viewers can review recent entries in Users.
The password service runs at most two scrypt operations at once and queues up to
16 more for up to two seconds. If that queue fills or the wait expires, the