Scopes

Tiled uses OAuth2 scopes to restrict the actions that users, services, and API keys can perform. See the guide Create and Use API Keys for instructions on generating API keys with restricted scopes.

List of Scopes

• read:metadata — List and search metadata.

• read:data — Fetch (array, table) data.

• create:node — Create a new node.

• write:metadata — Write metadata.

• write:data — Write (array, table) data.

• delete:revision — Delete metadata revisions

• delete:node — Delete a node

• create:apikeys — Create API keys for the currently-authenticated user or service.

• revoke:apikeys — Revoke API keys for the currently-authenticated user or service.

• metrics — Access Prometheus metrics.

• admin:apikeys — Manage API keys on behalf of any user or service.

• read:principals — Read list of all users and services and their attributes.

Finally, there is the meta-scope inherit, the default for API keys. It inherits the scopes of the Principal associated with this key, resolved at access time.

Roles

An authenticated entity (“Principal”) may be assigned roles that confer a list of scopes.

• user — default role, granted scopes ["read:metadata", "read:data", "write:metadata", "write:data", "create:node", "create:apikeys", "revoke:apikeys"]

• admin — granted all scopes

There is support for custom roles at the database level, but neither role creation/customization nor role assignment are yet exposed through the API. (This will come in a future release.)

For now, admin role can only be assigned by setting tiled_admins in the service configuration, as in this example.

example_configs/toy_authentication.py

authentication:
  providers:
  - provider: toy
    authenticator: tiled.authenticators:DictionaryAuthenticator
    args:
      users_to_passwords:
        alice: ${ALICE_PASSWORD}
        bob: ${BOB_PASSWORD}
        cara: ${CARA_PASSWORD}
        admin: "admin"
      confirmation_message: "You have logged in as {id}."
  tiled_admins:
    - provider: toy
      id: admin
database:
  # The authentication database, where the server records principals
  # (users and services) as they first log in. The access tags compiler
  # (example_configs/access_tags/compile_tags.py) reads it to generate a
  # principal tag ('user:alice', ...) for each principal, which is what
  # lets a principal create nodes without explicit access tags.
  uri: "sqlite:///./example_configs/authn.db"
  init_if_not_exists: true
access_control:
  access_policy: "tiled.access_control.access_policies:TagBasedAccessPolicy"
  args:
    provider: "toy"
    scopes:
    - "read:metadata"
    - "read:data"
    - "write:metadata"
    - "write:data"
    - "delete:revision"
    - "delete:node"
    - "create:node"
    - "register"
    # Access tag definitions are read from the catalog database (see trees).
    access_tags_parser: "tiled.access_control.access_tags:AccessTagsParser"
trees:
  - path: /
    tree: catalog
    args:
      uri: "sqlite+aiosqlite:///./example_configs/catalog/catalog.db"
      writable_storage: "./example_configs/catalog/data"
      init_if_not_exists: true
      top_level_access_tags: ["public"]