bobbanandClaude Sonnet 5
de5c39dddf
osTicket's own REST API only supports creating tickets, not listing or reading them, so this reads osTicket's MySQL/MariaDB database directly with a read-only user instead - the only integration in this app that isn't a REST API. Joins the ticket, status, priority, department, staff, team, and user tables, filtered to tickets in the "open" state (status names are customizable per install, but that state flag isn't). Surfaces per-ticket subject, priority, department, assignee, requester, and osTicket's own overdue/awaiting-reply flags, plus a page at /osticket and a Dashboard widget with open/overdue/awaiting-reply counts. Not verified against a live instance: unlike the HTTP-based integrations, there was no way to fake a MySQL server to test against in this environment, so the query is built from osTicket's published schema but has never actually run against a real database. See INTEGRATIONS.md for the read-only grant needed and further caveats. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
82 lines
3.7 KiB
Markdown
82 lines
3.7 KiB
Markdown
# Roles & menu access
|
|
|
|
Homelab Manager has three roles, ranked lowest to highest: **viewer**,
|
|
**operator**, **admin**. The first person to sign in becomes admin;
|
|
everyone after that starts as viewer until an admin changes their role
|
|
under **Administration → Users**.
|
|
|
|
A role can do everything the roles below it can, plus what's listed for
|
|
it — operator includes everything viewer has, admin includes everything
|
|
operator has.
|
|
|
|
## Sidebar menu, by role
|
|
|
|
✅ = the menu item appears for that role · ❌ = it's hidden entirely (not
|
|
just disabled) — a group that would end up with zero visible items
|
|
disappears too, and a group left with exactly one just shows as that
|
|
page's own top-level link.
|
|
|
|
| Menu item | Path | Viewer | Operator | Admin |
|
|
|---|---|:---:|:---:|:---:|
|
|
| Dashboard | `/` | ✅ | ✅ | ✅ |
|
|
| **Infrastructure** | | | | |
|
|
| Servers | `/servers` | ✅ | ✅ | ✅ |
|
|
| Proxmox | `/proxmox` | ✅ | ✅ | ✅ |
|
|
| Synology | `/synology` | ✅ | ✅ | ✅ |
|
|
| Proxmox Backup | `/pbs` | ✅ | ✅ | ✅ |
|
|
| Docker | `/docker` | ✅ | ✅ | ✅ |
|
|
| Tailscale | `/tailscale` | ✅ | ✅ | ✅ |
|
|
| **Network** | | | | |
|
|
| DNS | `/dns` | ✅ | ✅ | ✅ |
|
|
| Domains | `/domains` | ✅ | ✅ | ✅ |
|
|
| IP Addresses | `/ipam` | ✅ | ✅ | ✅ |
|
|
| Consistency | `/consistency` | ✅ | ✅ | ✅ |
|
|
| **Automation** | | | | |
|
|
| Semaphore | `/semaphore` | ✅ | ✅ | ✅ |
|
|
| Gitea | `/gitea` | ✅ | ✅ | ✅ |
|
|
| Secrets | `/secrets` | ✅ | ✅ | ✅ |
|
|
| **Operations** | | | | |
|
|
| Maintenance | `/maintenance` | ✅ | ✅ | ✅ |
|
|
| Uptime Kuma | `/uptime-kuma` | ✅ | ✅ | ✅ |
|
|
| osTicket | `/osticket` | ✅ | ✅ | ✅ |
|
|
| Generator | `/generator` | ✅ | ✅ | ✅ |
|
|
| **Administration** | | | | |
|
|
| Integrations | `/integrations` | ✅ | ✅ | ✅ |
|
|
| Users | `/users` | ❌ | ❌ | ✅ |
|
|
| Sessions | `/sessions` | ❌ | ❌ | ✅ |
|
|
| Audit Log | `/audit-log` | ❌ | ✅ | ✅ |
|
|
| Diagnostic Log | `/diag-log` | ❌ | ❌ | ✅ |
|
|
| Settings | `/settings` | ❌ | ❌ | ✅ |
|
|
| Privacy (footer link, not in a group) | `/privacy` | ✅ | ✅ | ✅ |
|
|
|
|
So in practice: **every page is visible to every role except the five
|
|
under Administration** — Users, Sessions, and Diagnostic Log need admin;
|
|
Audit Log needs operator or admin; Settings needs admin.
|
|
|
|
## Being able to see a page isn't the same as being able to change things
|
|
|
|
Almost every page above is visible to viewers, but most of the buttons
|
|
on them aren't — a viewer can look at everything but can't act on
|
|
anything. Operators can use the page's normal working actions (starting
|
|
a container, syncing DNS, adding a secret, opening a maintenance
|
|
window…). Some actions on otherwise-viewer-visible pages are held back
|
|
even further, to admin only:
|
|
|
|
- **Integrations & DNS providers**: any operator can use an integration
|
|
once it's configured (start/stop a guest, run a template, sync DNS
|
|
records, etc.), but adding, editing, testing, or deleting an
|
|
integration or DNS provider is admin-only.
|
|
- **Servers**: registering a new server, rotating its agent token, and
|
|
editing/deleting a server are admin-only; tagging a server and
|
|
linking/unlinking it to a Proxmox guest just need operator.
|
|
- **Tags**: creating, renaming, recoloring, or deleting a tag is
|
|
admin-only (applying an existing tag to a server needs operator).
|
|
- Everything under **Settings** (notification channels, badge colors,
|
|
display prefs, log retention, backup/restore) is admin-only, matching
|
|
the page itself being admin-only.
|
|
|
|
If you need the exact role for one specific button rather than this
|
|
summary, check the corresponding route in `server/src/routes/` — each
|
|
one that needs more than "signed in" calls `requireRole("operator")` or
|
|
`requireRole("admin")` right where that action is defined.
|