Access control

MPO Version: 1.3.0

Configuration chapter for defining the access control architecture of the project. Mindbricks supports multiple authorization models including role-based, user-based, object-based, and attribute-based access controls. This section enables a unified, flexible, and scalable permission system that ensures resources and operations are securely accessed based on defined authorization rules across services.

interface AccessControl = {
  permissionBasics : PermissionBasics;
  roleSettings : RBACSettings;
  permissionTypes : PermissionTypes;
  objectBasedSettings : OBACPermission;
  attributeBasedSettings : AbacPermission;
}

PermissionBasics

MPO Version: 1.3.0

Defines the foundational permission model of the project. This section enables Permission-Based Access Control (PBAC) by allowing the architect to organize granular permissions into named groups. These permission groups act as the reference set for roles, users, and object-level rules throughout the project.

interface PermissionBasics = {
  pbacIsActive : Boolean;
  configuration : PermissionBasicsConfig;
}

PermissionBasicsConfig

MPO Version: 1.3.0

Configuration details for permission basics, including permission groups.

interface PermissionBasicsConfig = {
  permissionGroups : PermissionGroup[];
}

PermissionGroup

MPO Version: 1.3.0

Defines a group of permissions under a shared namespace. Each permission group has a unique groupName and a list of permissions that are referenced across the project using either 'groupName.permission' or standalone permission identifiers. These groups simplify permission management in large-scale projects.

interface PermissionGroup = {
  groupName : String;
  permissions : String[];
}

RBACSettings

MPO Version: 1.3.0

Configuration for Role-Based Access Control (RBAC) within the project. When enabled, RBAC allows permissions to be assigned to named roles, which are then associated with users. This setup supports both single-role and multi-role configurations, along with custom logical roles defined by dynamic lookup conditions.

interface RBACSettings = {
  rbacIsActive : Boolean;
  configuration : RBACSettingsConfig;
}

RBACSettingsConfig

MPO Version: 1.3.0

Configuration details for RBAC, including roles, role ID data type, custom role lookups, and multi-role support.

interface RBACSettingsConfig = {
  roleItems : RoleItem[];
  customRoleLookups : DataMapItem[];
  usersHaveMultipleRoles : Boolean;
}

RoleItem

MPO Version: 1.3.0

Represents a role definition in the RBAC system. Each role includes a name for display and a value used in session data and permission checks.

interface RoleItem = {
  name : String;
  value : Any;
}

PermissionTypes

MPO Version: 1.3.0

Defines the active permission mechanisms in the project. Mindbricks supports multiple types of permission strategies including role-based (RBAC), user-specific overrides, user group-level permissions, object-level (OBAC), and tenant-specific rules. This configuration determines which of these models are enabled for the access control logic.

interface PermissionTypes = {
  roleBasedPermissionsIsActive : Boolean;
  userBasedPermissionsIsActive : Boolean;
  userGroupBasedPermissionsIsActive : Boolean;
  objectBasedPermissionsIsActive : Boolean;
  tenantBasedPermissionsIsActive : Boolean;
}

OBACPermission

MPO Version: 1.3.0

Configuration for Object-Based Access Control (OBAC), which restricts access to specific data objects based on object ownership or association. If your system requires permissions that vary per object instance (e.g., 'only the creator can edit this record'), OBAC should be enabled and the relevant data objects listed.

interface OBACPermission = {
  objectBasedPermissionsIsActive : Boolean;
  dataObjects : DataObjectName[];
}

DataObjectName

MPO Version: 1.3.0

Represents a reference to a data object within the project. The value can be either a simple object name or a qualified reference in the format 'serviceName:objectName'. When using the qualified format, the part before the ':' specifies the service name, and the part after specifies the object name within that service. If only a single name is provided (without ':'), the system first searches for the object in the current service, then searches across other services in the project. As a best practice, when referencing data objects from other services, always fully qualified 'serviceName:objectName' format should be used to avoid potential naming conflicts.

interface DataObjectName = {
}

AbacPermission

MPO Version: 1.3.0

Configuration for Attribute-Based Access Control (ABAC), allowing fine-grained permission control using attribute-level rules on data objects. ABAC evaluates access by applying custom filter conditions to each object. When a rule matches, the user session may be granted specific permissions or even dynamic roles for that object. These rules can supplement or override standard RBAC or OBAC logic.

interface AbacPermission = {
  attributeBasedPermissionsIsActive : Boolean;
  abacDefinitions : ABACDefinititon[];
}

ABACDefinititon

MPO Version: 1.3.0

Defines a single ABAC (Attribute-Based Access Control) rule for a given data object. Each rule applies a conditional filter to determine which records a user can access, and grants either dynamic permissions or a role for matching records.

interface ABACDefinititon = {
  name : String;
  dataObject : DataObjectName;
  whereClause : MScript;
  permissions : String[];
}