User Permissions

StellarStack uses a role-based access control (RBAC) system with granular permissions.

Role Hierarchy

Super Admin
    │
    ├── Admin
    │     ├── Moderator
    │     └── Support
    │
    └── User (default)
          └── Subuser (per-server)

Global Roles

Super Admin

Full platform access including:

• All admin capabilities
• Platform settings
• Blueprint management
• Billing access

Admin

Manage users and nodes:

• View/create/delete users
• Suspend users
• Manage user servers
• View/create/delete nodes
• Modify node settings

Moderator

Limited admin access:

• View user details
• Limited server management
• Support escalation

Support

Customer support access:

• View user details
• Read-only server access
• Create support tickets

User

Standard user account:

• Manage own servers
• Create subusers
• View assigned resources

Server Permissions

Individual permissions for server access:

Managing Subusers

Subusers are users with limited access to specific servers.

Add a Subuser

1. Navigate to Server → Users
2. Click Add User
3. Enter email address
4. Select permissions
5. Click Invite

Permission Templates

Create templates for common access patterns:

Read Only

• server.view
• server.console
• server.files.read

Operator

• All read permissions
• server.console.send
• server.start
• server.stop
• server.restart

Manager

• All operator permissions
• server.files.write
• server.settings
• server.schedules
• server.backups

Full Access

• All permissions except server.delete

API Permission Check

Permissions are checked at the API level:

// Middleware example
app.post("/servers/:serverId/start",
  authMiddleware,
  requirePermission("server.start"),
  async (c) => {
    // Handler only runs if user has permission
  }
);

Custom Permission Logic

const checkPermission = async (
  userId: string,
  serverId: string,
  permission: string
): Promise<boolean> => {
  // Check if user owns the server
  const server = await getServer(serverId);
  if (server.ownerId === userId) {
    return true;
  }

  // Check if user is a subuser with permission
  const subuser = await getSubuser(serverId, userId);
  if (subuser && subuser.permissions.includes(permission)) {
    return true;
  }

  // Check global admin role
  const user = await getUser(userId);
  if (user.role === 'admin' || user.role === 'superadmin') {
    return true;
  }

  return false;
};

Best Practices

1. Principle of Least Privilege - Grant only necessary permissions
2. Use Templates - Create permission templates for common roles
3. Audit Regularly - Review subuser access periodically
4. Document Access - Keep records of who has access to what
5. Revoke Promptly - Remove access when no longer needed