Users, roles and permissions

Every account has one role. A role carries a set of permissions and a priority. What an account can do is decided by the permissions; the priority decides who can act on whom.

Permissions decide what

A permission is a named capability, like store.orders.refund or forum.topics.delete. The core ships its own and every module declares the ones it needs in its manifest, so installing a module adds its permissions to the role editor and uninstalling it takes them away again.

Never infer permission from the screen that called. An endpoint checks the permission itself, because the admin panel is a convenience and the API is the same door.

Priority decides whom

A moderator cannot warn, ban or impersonate an account whose role outranks theirs. That is the only thing priority is for, and it is what stops a junior moderator from muting an administrator.

Resource grants

A permission is site-wide. A grant is the same permission narrowed to one thing: this person can moderate this forum category and no other. Grants are additive and never widen what the role already refuses.

The rules that protect the site from itself

Two of them are worth knowing because they look like bugs the first time you meet them.

The last administrator cannot be removed, demoted or deleted. Not by themselves and not by anyone else. A site with no administrator has no way back in except the database, so the check refuses the change and says why.

A password reset ends every other session. Changing a password logs out the laptop the account was signed in on, which is the entire point of changing it after a compromise.

Signing in as someone else

An administrator can impersonate an account to see what it sees. While it is happening the site carries a banner that cannot be dismissed, the action is in the audit log with both identities, and a nested impersonation is refused.

Deleting an account

Deleting a member anonymises what has to stay for the site to make sense and removes the rest. Their forum topics keep their replies and lose their author; their orders keep their totals for the books and lose the person. Every API key that account issued stops working in the same transaction.