Managing Roles and Permissions in the UI

Supamode provides a visual interface for managing your entire permission structure. This guide covers creating roles, permissions, and permission groups through the UI.

Prerequisites: You must be signed in with a role that has system permissions for role, permission, and account resources (typically Super Admin or Root).

Managing Roles

Roles define what users can do in Supamode. Every admin account has exactly one role, and that role determines their permissions.

Viewing Roles

Navigate to Settings > Permissions and select the Roles tab (/settings/permissions?tab=roles).

Click any role to view its details, including assigned permissions and permission groups.

Creating a Role

1. Click New Role in the top right
2. Fill in the role details:
   • Name: A descriptive name (e.g., "Content Editor", "Support Agent")
   • Description: What this role is for
   • Rank: The role's position in the hierarchy (0-100)

Understanding Role Rank

Rank determines who can manage whom:

• Higher rank users can manage lower rank users
• A rank 70 user cannot modify a rank 80 account
• Use this to prevent junior admins from elevating privileges

Recommended rank structure:

• Root/Super Admin: 100
• Admin: 90
• Developer: 80
• Manager: 70
• Support: 60
• Viewer: 50

Creating Permissions

Navigate to Settings > Permissions and select the Permissions tab (/settings/permissions?tab=permissions).

Click New Permission to create a new permission.

Permission Fields

System Permissions

System permissions control access to Supamode's admin features. Use these for managing users, roles, and system settings.

System resources:

• account - Manage Supamode accounts
• role - Create and edit roles
• permission - Manage permissions
• auth_user - Manage Supabase Auth users
• table - Configure table metadata
• log - Access audit logs
• system_setting - Modify system settings

Data Permissions

Data permissions control access to your database tables and storage buckets.

Table Permissions

Configure access to specific tables:

Use * as a wildcard:

• public.* grants access to all tables in public schema
• *.* grants access to all tables (use sparingly)

Storage Permissions

Configure access to Supabase Storage buckets:

Path patterns work like SQL LIKE:

• users/* matches all files in the users folder
• * matches all files in the bucket

Assigning Permissions to Roles

You can assign permissions to roles in two ways:

1. Direct assignment - Add individual permissions to a role
2. Permission groups - Create reusable bundles of permissions

Direct Assignment

1. Navigate to a role's detail page
2. Click Manage Permissions
3. Select the permissions to assign

Using Permission Groups

Permission groups bundle related permissions together. Assign a group to multiple roles, and updating the group updates all roles using it.

Creating a Permission Group

1. Go to Settings > Permissions > Permission Groups tab
2. Click New Permission Group
3. Add a name and description

Adding Permissions to a Group

1. Click on a permission group to view details
2. Click Manage Permissions
3. Select permissions to include

Assigning Groups to Roles

1. Navigate to a role's detail page
2. Click Manage Permission Groups
3. Select groups to assign

Example: Setting Up a Content Editor Role

Here's a practical example of creating a role for content editors:

1. Create the role:
   • Name: "Content Editor"
   • Description: "Can manage blog posts and media"
   • Rank: 60
2. Create permissions:
   • "Read All Posts" (Data, Table: public.posts, Action: select)
   • "Edit Posts" (Data, Table: public.posts, Action: update)
   • "Create Posts" (Data, Table: public.posts, Action: insert)
   • "Manage Media" (Data, Storage: media, Path: *, Action: *)
3. Create a permission group:
   • Name: "Content Management"
   • Add all four permissions above
4. Assign to role:
   • Open the Content Editor role
   • Click Manage Permission Groups
   • Add the Content Management group

Now any user assigned the Content Editor role can manage posts and media, but cannot access other tables or admin features.