Features

Accounts, roles and access

Who gets in, what each one reaches and how a lost access is recovered.

Every installation requires an account. With no user in the database, the first visit to http://localhost:3000 leads to the first-access screen, and the account created there is born an admin and a member of every workspace that already exists. After that there is no self-signup: accounts are created by an admin.

Two axes, and the narrowest wins

Role	In the installation	Inside a workspace
`ADMIN`	everything, Settings, Backup and Users included	implicit member of all of them, always
`MEMBER`	reads and writes on the boards they reach	writes
`VIEWER`	reads only	reads only

A VIEWER of the installation writes nowhere, even as a MEMBER of a workspace: the rule is the composition of the two, and the smaller always wins.

Everyone manages their own profile

Name, e-mail, job title, display timezone, avatar, password and API token belong to the account's owner, a VIEWER included: they do not write on the board, but they do change their own password. There is no /api/profile/[id]: nobody edits someone else's profile.

I forgot my password

There is no e-mail delivery in this installation. Recovery is an admin resetting the password under Users, and that reset drops all of that person's sessions: no older access stays valid.

One admin always remains

The last admin cannot be removed or demoted. The installation is never left with nobody able to give access back.

Authentication

Session, token and the role matrix.

User routes

Create accounts, change roles and set workspaces.