Groups and roles for your SaaS, without building multi-tenancy
Last updated
Seed gives every account a personal group at sign-up, and people make shared groups, invite others and give them roles from viewer to owner. The group is the one tenancy boundary, so a feature you add passes the same check as soon as it copies the notes aggregate.
- The group is the one tenancy boundary: personal and shared data pass the same check
- The app, its code and this site all call it a group
- No second permission model to keep in sync with the first
- Invitations, role changes and ownership transfer, each with its own tests
Every row of shared data belongs to a group, and the API checks the person's role in that group before it reads or writes. A viewer reads, an editor also changes the group's data, and an admin and the owner also manage members and read the activity log.
The owner hands ownership over in one step, and a deleted group can be restored within 30 days. Only an account whose email address is confirmed can invite.
Does every account get a group?
Yes. Each account gets a personal group at sign-up; a personal group and a shared one pass the same check.
Can a viewer change a group's data?
No. A viewer reads the group's data; an editor, an admin or the owner can change it.
Can a deleted group come back?
Yes. Its owner can restore it within 30 days; after that the worker removes it for good.
Do I need a second permission system for my own features?
No. A new aggregate copies the notes aggregate and its group check, so there is one permission model to keep.