Authorization

This documentation provides an overview of the roles within Massdriver and the corresponding permissions for each role regarding GraphQL operations.

Roles

Organization Viewer

All organization members are granted the "organization viewer" role, allowing them to:

• acceptGroupInvitation
• addServiceAccountToGroup
• applicationBundleTemplates
• artifactDefinition
• artifactDefinitions
• artifact
• artifacts
• cloudDnsZones
• cloud
• compareEnvironments
• containerRepositories
• containerRepository
• createApplicationBundle
• defaultableEnvironmentConnectionGroups
• dnsZones
• environment
• filterArtifactsByType
• getPackageByNamingConvention
• group
• groups
• importableResources
• instanceTypes
• manifest
• metricTimeSeries
• organization
• package
• project
• projects

Organization Admin

In addition to the organization viewer permissions, "organization admin" can perform:

• addServiceAccountToGroup
• artifactDefinition
• auditLogs
• billingSubscription
• bundle
• connectDnsZone
• createArtifact
• createDnsZone
• createEnvironmentConnection
• createGroupInvitation
• createGroup
• createManifest
• createSubscriptionManagementSession
• deactivateServiceAccount
• deleteArtifact
• deleteBundle
• deleteGroupInvitation
• deleteGroupMembership
• deleteGroup
• deleteOrganizationMember
• deleteServiceAccount
• disconnectDnsZone
• grantGroupAccess
• publishArtifactDefinition
• publishBundle
• reactivateServiceAccount
• removeServiceAccountFromGroup
• serviceAccounts
• updateGroup

Project Viewer

"Project viewer" roles allow views on specific project-related GraphQL operations:

• assignRemoteReference
• compareDeployments
• deployPreviewEnvironment
• deployment
• deployments
• environment
• disconnectImportedResources
• downloadArtifact
• getPackageByNamingConvention
• grantGroupAccess
• importResources
• importableResources
• instanceTypes
• manifest
• metricTimeSeries
• package
• watchMetric

Project Admin

In addition to the project viewer permissions, a "project admin" can:

• assignRemoteReference
• configurePackage
• createEnvironmentConnection
• createEnvironment
• createImportableManifest
• createManifest
• createProject
• createServiceAccount
• createWatchedMetricPackageAlarm
• decommissionPackage
• decommissionPreviewEnvironment
• deleteEnvironmentConnection
• deleteEnvironment
• deleteManifest
• deleteProject
• deleteWatchedMetricPackageAlarm
• deployPackage
• disconnectImportedResources
• linkManifests
• setDefaultSecretForPreviewEnvironments
• setManifestPosition
• setPackageSecret
• unsetDefaultSecretForPreviewEnvironments
• unsetPackageSecret
• unlinkManifests
• unsetRemoteReference
• unwatchMetric
• updateArtifact
• updateEnvironment
• updateManifest
• updateProject
• watchMetricAndCreatePackageAlarm
• createWatchedMetricPackageAlarm

Authorization Rule Details

All resources in Massdriver roll up to either an organizational or project boundary. Specific permissions on GraphQL operations are contingent on the boundary and role of the user in relation to that boundary.