Skip to main content

Security

Roles​

tip

You can define as many tokens you want in the X_ACCESS_TOKENS by separating them with a comma ,.

ie. READ_ACCESS_TOKENS=token_a,token_b,token_c

Read​

Read tokens can access the models definitions as well as any document without the permission to decrypt.

Example of encrypted entity
{
  ...
  "email": {
    "hash": "b8cccea15437aef415090bda6acb3b0ad3d4cf7d3e4cf816772e4b43e8f9d08af392bb98b8d532e07249f0d1304e6d65e007205c39913ee5db95578be398f4bd",
    "encrypted": "testte:bde015bb0ebdb379de02b6040b5b086abcd8464d2f2d76e0b7c23c00d8928ec6:45c7b2c62ed111e4ea206d29b1e0:7100ad6143e11c5b4d219651cf9dddd1:aes-256-gcm"
  },
  ...
}

Exact search are still possible thanks to the hash but not full text or partial searches.

ds accounts count --email john@doe.org --must-hash
# 1

Decrypt​

Decrypt tokens has the Read tokens permissions as well as the one to decrypt values.

Example of decrypted entity
{
  ...
  "email": "john@doe.org",
  ...
}

Write​

Write tokens can read, decrypt and write data.

Admin​

Admin tokens has full permission including the ability to create or update entities contracts definitions.