diff --git a/frontend/src/component/project/ProjectAccess/ProjectAccessAssign/ProjectAccessAssign.tsx b/frontend/src/component/project/ProjectAccess/ProjectAccessAssign/ProjectAccessAssign.tsx index a5ece25497..f572c9d019 100644 --- a/frontend/src/component/project/ProjectAccess/ProjectAccessAssign/ProjectAccessAssign.tsx +++ b/frontend/src/component/project/ProjectAccess/ProjectAccessAssign/ProjectAccessAssign.tsx @@ -351,7 +351,7 @@ export const ProjectAccessAssign = ({ modal title={`${!edit ? 'Assign' : 'Edit'} ${entityType} access`} description='Custom project roles allow you to fine-tune access rights and permissions within your projects.' - documentationLink='https://docs.getunleash.io/how-to/how-to-create-and-assign-custom-project-roles' + documentationLink='https://docs.getunleash.io/reference/rbac/create-and-assign-a-custom-project-role' documentationLinkLabel='Project access documentation' formatApiCode={formatApiCode} > diff --git a/website/docs/feature-flag-tutorials/use-cases/security-compliance.md b/website/docs/feature-flag-tutorials/use-cases/security-compliance.md index a8b2ce5abd..343ad2f908 100644 --- a/website/docs/feature-flag-tutorials/use-cases/security-compliance.md +++ b/website/docs/feature-flag-tutorials/use-cases/security-compliance.md @@ -88,7 +88,7 @@ Unleash is built with many mechanisms in place to handle all of these scenarios. Let’s look at how Unleash gives you complete control over user roles and permissions. At a high level, there are multiple [predefined roles](/reference/rbac#predefined-roles) in Unleash for you to get started with. Root roles control permissions to top-level resources, spanning across all projects. Project roles, on the other hand, control permissions for a project, the feature flags, and individual configurations per environment. -The three predefined root roles are: Admin, Editor, and Viewer. The predefined project roles are Owner and Member. In addition to these, you can also create [custom root](/how-to/how-to-create-and-assign-custom-root-roles) or [project roles](/how-to/how-to-create-and-assign-custom-project-roles). The following diagram provides a visual overview of how root roles and project roles compare. +The three predefined root roles are: Admin, Editor, and Viewer. The predefined project roles are Owner and Member. In addition to these, you can also create [custom root roles](/reference/rabc/create-and-assign-a-custom-root-role) or [project roles](/reference/rbac/create-and-assign-a-custom-project-role). The following diagram provides a visual overview of how root roles and project roles compare. ![The diagram showing the relationship between root roles and project roles in Unleash.](/img/root-and-project-roles-comparison.jpg) diff --git a/website/docs/feature-flag-tutorials/use-cases/user-management-access-controls.md b/website/docs/feature-flag-tutorials/use-cases/user-management-access-controls.md index ebb872cd98..d90240ecfe 100644 --- a/website/docs/feature-flag-tutorials/use-cases/user-management-access-controls.md +++ b/website/docs/feature-flag-tutorials/use-cases/user-management-access-controls.md @@ -97,7 +97,7 @@ Viewers can observe projects and flags, but cannot make changes. When added to a Project permissions are separated from root permissions to make it even more targeted regarding what permissions someone can and cannot have in Unleash. -For more fine-tuned access controls, create [custom root roles](/how-to/how-to-create-and-assign-custom-root-roles) and [custom project roles](/how-to/how-to-create-and-assign-custom-project-roles), where you can define the privileges and limitations beyond the predefined roles we have built into Unleash. +For more fine-tuned access controls, create [custom root roles](/reference/rbac/create-and-assign-a-custom-root-role) and [custom project roles](/reference/rbac/create-and-assign-a-custom-project-role), where you can define the privileges and limitations beyond the predefined roles we have built into Unleash. For example, customize root permissions to perform CRUD operations for: diff --git a/website/docs/how-to/how-to-create-and-assign-custom-project-roles.mdx b/website/docs/how-to/how-to-create-and-assign-custom-project-roles.mdx deleted file mode 100644 index d8d8f3e1e9..0000000000 --- a/website/docs/how-to/how-to-create-and-assign-custom-project-roles.mdx +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to create and assign custom project roles ---- - -import VideoContent from '@site/src/components/VideoContent.jsx' - -:::note Availability - -**Plan**: [Enterprise](https://www.getunleash.io/pricing) | **Version**: `4.6+` - -::: - - -This guide takes you through [how to create](#creating-custom-project-roles "how to create custom project roles") and [assign](#assigning-custom-project-roles "how to assign custom project roles") [custom project roles](../reference/rbac.md#custom-project-roles). Custom project roles allow you to fine-tune access rights and permissions within your projects. - - - -## Creating custom project roles - -It takes about three steps to create custom project roles: - -1. Navigate to the custom project roles page by using the admin menu (the gear symbol) and navigating to users. - ![A visual representation of the current step: the Unleash Admin UI with the steps highlighted.](/img/create-cpr-step-1.png) -2. Navigate to the "Project roles" tab. - ![The admin/roles screen, with the project roles tab highlighted. The page shows a table of project roles with their descriptions.](/img/create-cpr-step-2.png) -3. Use the "New project role" button to open the role creation form. - ![The visual position of the 'new project role' button on the page.](/img/create-cpr-step-3.png) -4. Give the role a name, an optional description, and the set of permissions you'd like it to have. For a full overview of all the options, consult the [custom project roles reference documentation](../reference/rbac.md#custom-project-roles). - ![The project role creation form filled in with details for a "developer" role. To the left is the equivalent cURL command you could run if you wanted to use the API instead of the form.](/img/create-cpr-step-4.png) - - - -## Assigning custom project roles - -:::note Availability - -**Plan**: [Enterprise](https://www.getunleash.io/pricing) | **Version**: `5.6+`. - -::: - -Assigning a custom project role is a pretty straightforward process and requires three steps, outlined below. - -To assign a custom project role to a user: -1. Navigate to the project you want to assign the user a role in. - ![The steps to navigate to a project: use the 'projects' navigation item and select your project.](/img/assign-cpr-step-1.png) -2. Navigate to the project's _access_ tab. - ![A project overview with the 'access' tab highlighted.](/img/assign-cpr-step-2.png) -3. This step depends on whether the user has already been added to the project or not: - - If the user has already been added to the project, click on the edit icon corresponding with its line and from the overlay that will show up select the new role you want to assign it from the dropdown and save the changes. - ![A list of users with access to the current project. To the right of each user is a dropdown input labeled role.](/img/assign-cpr-step-3a.png) - - If the user _hasn't_ been added to the project, add them using the button 'Assign user/group'. From the overlay that will show up select the user, assign it a role and save the changes. Now you should be able to see the new user in the table. - ![Adding a user to a project. The add user form is filled out with data for an "Alexis". The Role input is open and the custom "Developer" role is highlighted.](/img/assign-cpr-step-3b.png) diff --git a/website/docs/how-to/how-to-create-and-assign-custom-root-roles.md b/website/docs/how-to/how-to-create-and-assign-custom-root-roles.md deleted file mode 100644 index 8282eec285..0000000000 --- a/website/docs/how-to/how-to-create-and-assign-custom-root-roles.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: How to create and assign custom root roles ---- - -:::note Availability - -**Plan**: [Enterprise](https://www.getunleash.io/pricing) | **Version**: `5.4+` - -::: - - -This guide takes you through [how to create](#creating-custom-root-roles "how to create custom root roles") and [assign](#assigning-custom-root-roles "how to assign custom root roles") [custom root roles](../reference/rbac.md#custom-root-roles). Custom root roles allow you to fine-tune access rights and permissions to root resources in your Unleash instance. - -## Creating custom root roles - -### Step 1: Navigate to the custom root roles page {#create-step-1} - -Navigate to the _roles_ page in the admin UI (available at the URL `/admin/roles`). Use the _settings_ button in the navigation menu and select "roles". - -![The admin UI admin menu with the Roles item highlighted.](/img/create-crr-step-1.png) - -### Step 2: Click the "new root role" button. {#create-step-2} - -Use the "new root role" button to open the "new root role" form. - -![The "root roles" table with the "new root role" button highlighted.](/img/create-crr-step-2.png) - -### Step 3: Fill in the root role form {#create-step-3} - -Give the root role a name, a description, and the set of permissions you'd like it to have. For a full overview of all the options, consult the [custom root roles reference documentation](../reference/rbac.md#custom-root-roles). - -![The root role form filled with some example data, and the "add role" button highlighted at the bottom.](/img/create-crr-step-3.png) - -## Assigning custom root roles - -You can assign custom root roles just like you would assign any other [predefined root role](../reference/rbac.md#predefined-roles). Root roles can be assigned to users, [service accounts](../reference/service-accounts.md), and [groups](../reference/rbac.md#user-groups). diff --git a/website/docs/how-to/how-to-manage-public-invite-tokens.mdx b/website/docs/how-to/how-to-manage-public-invite-tokens.mdx deleted file mode 100644 index 77df6e2d8e..0000000000 --- a/website/docs/how-to/how-to-manage-public-invite-tokens.mdx +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: How to manage public invite tokens ---- - -[Public invite links](../reference/public-signup.mdx) let you invite new members to an Unleash instance. A key part of an invite link is the public invite token. This guide shows you how to use the Unleash admin UI to create, update, and delete public invite tokens. You can also [manage public signup tokens via the Unleash API](../reference/api/unleash/public-signup-tokens.tag.mdx). - -Only Unleash instance admins have the necessary permissions to create and manage public invite tokens. - -## Creating a token - -1. Navigate to the **users** page in Unleash and use the **create invite link** button - -![The settings menu in the Unleash nav bar with the "users" link highlighted.](/img/public-signup-step1.png) - -![The Unleash users page. There is a separate "create invite link" section above the list of users.](/img/public-signup-step2.png) - -2. Fill out the "create invite link" form and (optionally) copy the invite link. You can always get the link later. -![A short form with only one field: token expiry.](/img/public-signup-step3-create_link.png) - -![An "invite link created" modal. It contains an invite link that can be copied and some info on how to use it.](/img/public-signup-step4_link_Created.png) - -## Updating/Deleting a token - -1. Follow the steps in [the previous paragraph](#creating-a-token) to navigate to the users page. -2. When you have an active invite token, use the button labeled "update invite link". -3. Use the form to edit the expiry for the token or to delete it entirely. diff --git a/website/docs/reference/public-signup.mdx b/website/docs/reference/public-signup.mdx index 38c3099839..001dfd4ee2 100644 --- a/website/docs/reference/public-signup.mdx +++ b/website/docs/reference/public-signup.mdx @@ -2,24 +2,14 @@ title: Public Invite Links --- -Public invite links let you invite team members to your Unleash instance. Any user with an invite link can sign up to Unleash instance that created the link. The user will get the **viewer** role (refer to the [predefined roles_ section of the RBAC document](../reference/rbac.md#predefined-roles) for more information on roles). +Public invite links allow you to invite new team members to your Unleash instance. Any user who receives an invite link can use it to sign up for the Unleash instance that generated the link. When users sign up using an invite link, they are automatically assigned the [Viewer](../reference/rbac.md#predefined-roles) role. -User who follow the invite link are taken directly to the Unleash sign-up page, where they can create an account. +A token becomes active as soon as you create it, and remains valid until it expires or is deleted. Once a token is invalid, users can no longer sign up using an invite link containing that token. -Only **Unleash instance admins** can create public invite links. +You can have only one active invite token at any given time. If an active token already exists, you must delete it before you can [create a new one](#manage-the-public-invite-token). -![An Unleash signup form for new users](/img/public-invite_signup.png) +## Manage the public invite token -## Public sign-up tokens +As an Admin, you can create, update, and delete invite tokens through the Unleash Admin UI in **Admin settings > User config > Users > Create invite link**. -The most important part of a public sign-up link is the sign-up token. The token is added as the `invite` query parameter to the invite link. - -Each token has an **expiry date**. After this expiry date, the token will stop working and users can no longer sign up using an invite link with that token. - -## Creating, updating, and deleting tokens - -You can [create, update and delete tokens via the Unleash Admin UI](../how-to/how-to-manage-public-invite-tokens.mdx) or via the [Unleash API](../reference/api/unleash/public-signup-tokens.tag.mdx "Public sign-up tokens API documentation"). - -A token is active as soon as it's created and stops working as soon as it's deleted or expired. - -You can only have one active invite token at a time. If you already have an active token, you must delete it to create a new one. +Alternatively, you can use [Admin API](../reference/api/unleash/public-signup-tokens.tag.mdx) to manage the public invite token. \ No newline at end of file diff --git a/website/docs/reference/rbac.md b/website/docs/reference/rbac.md index d18d828872..1a7e849919 100644 --- a/website/docs/reference/rbac.md +++ b/website/docs/reference/rbac.md @@ -40,8 +40,7 @@ own [custom root roles](#custom-root-roles) and [custom project roles](#custom-p Custom root roles let you define your own root roles with a specific set of root permissions. The roles can then be assigned to entities (users, service accounts, and groups) at the root level. This allows you to control access to -resources in a more precise, fine-grained way. For a step-by-step walkthrough of how to create and assign custom root -roles, refer to [_how to create and assign custom root roles_](../how-to/how-to-create-and-assign-custom-root-roles.md). +resources in a more precise, fine-grained way. Each custom root role consists of: @@ -49,6 +48,21 @@ Each custom root role consists of: - a **role description** (required) - a set of **root permissions** (required) +### Create and assign a custom root role + +To create a custom root role in the Admin UI, do the following: + +1. In **Admin settings > User config > Root roles**, click **New root role**. +2. Give the role a name and description and select all permissions you want to assign to the role. +3. Click **Add role** to save. + +Once you have the role set up, you can assign it a user: + +1. In **Admin settings > User config > Users**, select the user you want to assign the role to. +2. Click **Edit user**. +3. For **Role**, select the root role you want the user to have. +4. Click **Save**. + ### Root permissions You can assign the following root permissions: @@ -104,7 +118,7 @@ You can assign the following root permissions: | Change instance banners | Change instance [banners](./banners). | | Change maintenance mode state | Change [maintenance mode](./maintenance-mode) state. | | Update CORS settings | Update [CORS settings](./front-end-api#configure-cross-origin-resource-sharing-cors). | -| Read instance logs and login history | Read instance logs and [login history](./login-history.md). | +| Read instance logs and login history | Read instance logs and [login history](./login-history). | #### Integration permissions @@ -173,9 +187,7 @@ You can assign the following root permissions: Custom project roles let you define your own project roles with a specific set of project permissions down to the environment level. The roles can then be assigned to users in specific projects. All users have viewer access to all -projects and resources but must be assigned a project role to be allowed to edit a project's resources. For a -step-by-step walkthrough of how to create and assign custom project roles, see [_how to create and assign custom project -roles_](../how-to/how-to-create-and-assign-custom-project-roles). +projects and resources but must be assigned a project role to be allowed to edit a project's resources. Each custom project role consists of: @@ -183,6 +195,20 @@ Each custom project role consists of: - a **role description** (required) - a set of **project and environment permissions** (required) +### Create and assign a custom project role + +To create a custom project role in the Admin UI, do the following: + +1. In **Admin settings > User config > Project roles**, click **New project role**. +2. Give the role a name and description and select all permissions you want to assign to the role. +3. Click **Add role** to save. + +Once you have the role set up, you can assign it to individual users inside a project: + +1. In **Settings > User access**, click **Edit**. +2. For **Role**, select the custom project roles you want to apply. +3. Click **Save**. + ### Project permissions You can assign the following project permissions. These permissions are valid across all of the [project](./projects)'s diff --git a/website/docs/understanding-unleash/hosting-options.mdx b/website/docs/understanding-unleash/hosting-options.mdx index 173448a7d8..1df9e812f1 100644 --- a/website/docs/understanding-unleash/hosting-options.mdx +++ b/website/docs/understanding-unleash/hosting-options.mdx @@ -130,4 +130,4 @@ Unleash Proxy has been deprecated, use [Unleash Edge](../reference/unleash-edge) ::: -If you are currently self-hosting Proxy, see our [Edge migration guide](https://github.com/Unleash/unleash-edge/blob/main/docs/migration-guide.md) for a guide on how to migrate. +If you are currently self-hosting [Proxy](../reference/unleash-proxy), see our [Edge migration guide](https://github.com/Unleash/unleash-edge/blob/main/docs/migration-guide.md) for a guide on how to migrate. diff --git a/website/sidebars.ts b/website/sidebars.ts index e755e8a721..a8a0e6e8b3 100644 --- a/website/sidebars.ts +++ b/website/sidebars.ts @@ -615,7 +615,6 @@ const sidebars: SidebarsConfig = { 'generated/unleash-edge/migration-guide', ], }, - 'generated/unleash-proxy', { type: 'category', label: 'Compliance', @@ -714,8 +713,6 @@ const sidebars: SidebarsConfig = { label: 'Users and permissions', items: [ 'how-to/how-to-add-users-to-unleash', - 'how-to/how-to-create-and-assign-custom-root-roles', - 'how-to/how-to-create-and-assign-custom-project-roles', 'how-to/how-to-create-and-manage-user-groups', 'how-to/how-to-set-up-group-sso-sync', ], diff --git a/website/static/img/create-cpr-step-1.png b/website/static/img/create-cpr-step-1.png deleted file mode 100644 index 4ac7b1a96c..0000000000 Binary files a/website/static/img/create-cpr-step-1.png and /dev/null differ diff --git a/website/static/img/create-cpr-step-2.png b/website/static/img/create-cpr-step-2.png deleted file mode 100644 index ae6496f703..0000000000 Binary files a/website/static/img/create-cpr-step-2.png and /dev/null differ diff --git a/website/static/img/create-cpr-step-3.png b/website/static/img/create-cpr-step-3.png deleted file mode 100644 index fcfb7c75c9..0000000000 Binary files a/website/static/img/create-cpr-step-3.png and /dev/null differ diff --git a/website/static/img/create-cpr-step-4.png b/website/static/img/create-cpr-step-4.png deleted file mode 100644 index de111e4203..0000000000 Binary files a/website/static/img/create-cpr-step-4.png and /dev/null differ diff --git a/website/static/img/create-crr-step-1.png b/website/static/img/create-crr-step-1.png deleted file mode 100644 index 1d1c7e8052..0000000000 Binary files a/website/static/img/create-crr-step-1.png and /dev/null differ diff --git a/website/static/img/create-crr-step-2.png b/website/static/img/create-crr-step-2.png deleted file mode 100644 index 9d7a0510f8..0000000000 Binary files a/website/static/img/create-crr-step-2.png and /dev/null differ diff --git a/website/static/img/create-crr-step-3.png b/website/static/img/create-crr-step-3.png deleted file mode 100644 index fb2044e0ba..0000000000 Binary files a/website/static/img/create-crr-step-3.png and /dev/null differ diff --git a/website/static/img/public-signup-step1.png b/website/static/img/public-signup-step1.png deleted file mode 100644 index f99f121c0f..0000000000 Binary files a/website/static/img/public-signup-step1.png and /dev/null differ diff --git a/website/static/img/public-signup-step2.png b/website/static/img/public-signup-step2.png deleted file mode 100644 index ad0755f699..0000000000 Binary files a/website/static/img/public-signup-step2.png and /dev/null differ diff --git a/website/static/img/public-signup-step3-create_link.png b/website/static/img/public-signup-step3-create_link.png deleted file mode 100644 index ee1730ed20..0000000000 Binary files a/website/static/img/public-signup-step3-create_link.png and /dev/null differ diff --git a/website/static/img/public-signup-step4_link_Created.png b/website/static/img/public-signup-step4_link_Created.png deleted file mode 100644 index b81dde532e..0000000000 Binary files a/website/static/img/public-signup-step4_link_Created.png and /dev/null differ diff --git a/website/vercel.json b/website/vercel.json index 6389744092..cbe778c282 100644 --- a/website/vercel.json +++ b/website/vercel.json @@ -811,11 +811,26 @@ "destination": "/reference/login-history", "permanent": true }, + { + "source": "how-to/how-to-manage-public-invite-tokens", + "destination": "/reference/public-signup", + "permanent": true + }, { "source": "/how-to/how-to-create-feature-toggles", "destination": "/how-to-create-feature-flag", "permanent": true }, + { + "source": "/how-to/how-to-create-and-assign-custom-root-roles", + "destination": "/reference/rbac#create-and-assign-a-custom-root-role", + "permanent": true + }, + { + "source": "/how-to/how-to-create-and-assign-custom-project-roles", + "destination": "/reference/rbac#create-and-assign-a-custom-project-role", + "permanent": true + }, { "source": "/how-to/how-to-add-strategy-constraints", "destination": "/reference/activation-strategies#add-strategy-constraint",