RBAC System

Role-Based Access Control (RBAC) provides fine-grained permission management for your status page application.

Overview

The RBAC system defines four default roles with hierarchical permissions. Each role inherits permissions from lower-level roles and adds additional capabilities.

Default Roles

OWNER

The highest level of access. Owners have complete control over the system, including user management, system settings, and all administrative functions.

Full access to all features
Manage all users and roles
Access system settings and configuration
View and export audit logs
Delete status pages and critical data

ADMIN

Administrative access for day-to-day management of status pages.

Create and manage status pages
Manage components and groups
Create and resolve incidents
Schedule maintenance windows
Manage subscribers
Access API keys

MEMBER

Standard team member access for operational tasks.

Create and update incidents
View components and status pages
Add incident updates
View subscriber count (not details)

READ_ONLY

View-only access for monitoring purposes.

View dashboard
View status pages
View incidents (current and history)
View component status

Permission Matrix

Permission	OWNER	ADMIN	MEMBER	READ_ONLY
`dashboard.view`	✅	✅	✅	✅
`statuspage.create`	✅	✅	❌	❌
`statuspage.edit`	✅	✅	❌	❌
`statuspage.delete`	✅	❌	❌	❌
`incident.create`	✅	✅	✅	❌
`incident.edit`	✅	✅	✅	❌
`incident.delete`	✅	✅	❌	❌
`component.create`	✅	✅	❌	❌
`component.edit`	✅	✅	❌	❌
`maintenance.create`	✅	✅	✅	❌
`user.manage`	✅	❌	❌	❌
`settings.edit`	✅	❌	❌	❌
`audit.view`	✅	✅	❌	❌
`audit.viewSensitive`	✅	❌	❌	❌

Checking Permissions

In code, use the RBAC utility functions:

import { hasPermission, requirePermission } from '@/lib/rbac'

// Check if user has permission
if (hasPermission(user.role, 'incident.create')) {
  // User can create incidents
}

// Require permission (throws error if not allowed)
requirePermission(user.role, 'statuspage.delete')

// Check multiple permissions
const canManage = hasPermission(user.role, ['component.create', 'component.edit'])

Sensitive Data Filtering

The AUDIT_VIEW_SENSITIVE permission controls access to sensitive information in audit logs:

IP addresses
Session IDs
Password hashes
User agents
API tokens

Users without this permission will see [FILTERED] instead of actual sensitive values.

API Permissions

API keys inherit the permissions of the user who created them. Each API key can optionally have restricted scopes:

// API key with limited scopes
{
  "scopes": ["incident.read", "component.read"],
  "expiresAt": "2024-12-31T23:59:59Z"
}

Security Best Practice

Always use the principle of least privilege. Assign the minimum permissions necessary for each user's role.

Custom Roles (Coming Soon)

Future versions will support custom roles with configurable permissions. This will allow you to create roles like "Incident Manager" or "Component Admin" with specific permission sets.