Role-Based Access Control (RBAC)

Muljax ID implements a granular, resource-based access control engine. Every administrative action and sensitive API operation is guarded by permission checks.

System Roles

The system initializes three immutable system roles:

Role ID	Name	Type	Description	Default Permissions
admin	Administrator	System	Superadministrator with unrestricted platform access	[“*”]
user	User	System	Standard authenticated user self-service	[“ssh:cert:issue”, “ssh:keys:manage”, “ssh:ca:read”]
everyone	Everyone	System	Universal role applied to all requests (strictly read-only)	[“ssh:ca:read”]

Automatic D1 Seeding

These three immutable system roles and all canonical permissions are seeded into Cloudflare D1 automatically on every deployment via bun run deploy (or explicitly with bun run seed). Existing roles and custom assignments are preserved safely using idempotent SQLite INSERT OR IGNORE clauses.

---

Permissions Catalog

Permissions follow the standard resource:action convention. Wildcards (*) expand to match all actions under a given resource.

System & Users

• *: Superadministrator access across the entire platform.
• users:read: View user profiles and list registered accounts.
• users:write: Create, edit, and update user profile attributes.
• users:delete: Permanently delete user accounts.
• users:lifecycle: Enable, disable, and schedule delayed account actions.
• users:password-reset: Generate password reset links and tokens.
• users:*: All user management actions.

Roles & Permissions

• roles:read: View existing roles and their assigned permission sets.
• roles:write: Create, update, or delete custom roles.
• roles:assign: Bind or unbind roles to/from users.
• permissions:read: View the system permissions catalog.
• roles:*: Full control over roles and permissions.

OAuth Clients

• oauth_clients:read: View registered OAuth 2.0 / OIDC applications.
• oauth_clients:write: Create applications, update redirect URIs, and rotate client secrets.
• oauth_clients:*: Full control over OAuth applications.

SSH & Certificate Authority

• ssh:ca:read: View CA public keys, fingerprints, and revocation lists.
• ssh:keys:manage: Register, view, and delete personal SSH public keys.
• ssh:cert:issue: Request and receive signed OpenSSH user certificates.
• ssh:cert:list: View global history of all issued certificates across all users.
• ssh:cert:revoke: Revoke certificates and update the Key Revocation List.
• ssh:keys:admin: View and delete keys belonging to other users.
• ssh:*: Full control over CA, keys, certificates, and revocations.

Notifications & Settings

• notifications:read: View notifications and system alerts.
• notifications:write: Dismiss, mark read, or emit notifications.
• settings:read: View tenant and instance configuration.
• settings:write: Modify tenant and instance configuration.

---

Managing Roles in the Dashboard

Under Admin -> Roles (/admin/roles):

• Create Custom Role: Specify a unique slug, name, and description, and toggle individual permissions from the catalog.
• Assign to Users: Assign one or more roles per user under Admin -> Users -> Roles. User permissions are the union of all permissions granted across assigned roles.
• Read-Only Constraints: The everyone role is restricted; only permissions ending with :read can be assigned to it.