Users & Roles

Chinaski has two account roles (admin and editor) plus per-user restrictions that let you scope an editor to particular content types or languages. This page explains what each role can do, how accounts are created and managed, and the safeguards that keep user management from locking everyone out.

The two roles

Admin: full access. Only admins can manage users, API keys, backups, and site settings, and only admin routes are enforced server-side (checking the browser alone is never trusted).

Editor: writes and manages content. Self-registered and SSO-provisioned accounts are always created as editors; admins can choose either role when creating an account (anything else is coerced to editor before it’s saved).

Scoping an editor’s powers

A user account can carry two restriction lists: an admin sets them on the user’s edit screen:

Allowed content types: if empty, the editor may manage everything. If set, they can only manage the listed areas: pages, posts, blocks, snippets, documents, categories, forms, media, navigation, stacks, design tokens, and redirects. Trying to open another area sends them back to the dashboard with a “not authorised” message.
Allowed languages: if empty, the editor may work in every language; if set, they see and manage only those languages.

Admins are always exempt from both restrictions.

Creating accounts

Admins can create accounts directly in the admin area, with:

A username of 3–32 characters (letters, digits, underscore, period, hyphen).
A role of admin or editor.
A password meeting the standard requirements (at least 8 characters, upper, lower, digit).
An optional email.

Two conveniences come with this:

Invite on create: the form can email the new user an invitation link valid for 7 days so they can set (or change) their own password.
CSV import: upload a spreadsheet of accounts, up to 4 MiB, with username, password, and role columns, handy for migrating a team.

There are also non-admin ways accounts appear:

Self-registration (off by default; enabled in settings) creates an editor account subject to the standard rules and registration rate limits.
SSO sign-in auto-provisions an editor account the first time an authorized user arrives, with a random unusable password and, if the name is taken, a numbered suffix on the username.
For an existing user, admins can separately email a password reset link (valid 1 day) or an invite link (valid 7 days); each requires an email on file and replaces any outstanding link for that user.

Everyday admin powers over users

From the users list, administrators can:

Suspend someone: a suspended user is locked out at sign-in (they see the same “invalid credentials” message everyone else sees) and is immediately signed out of all their devices. You cannot suspend yourself. Unsuspending restores access at any time.
Delete an account: this removes the user plus their sessions and reset links. As safeguards, you can’t delete your own account, and deleting is blocked if it would leave the site with no users at all.
Bulk change: select multiple users to delete, change role (make admin / make editor), or suspend/unsuspend in one action. You’re never included in your own bulk selection, and delete can’t remove every last user.
Reset or set a password (as covered on the Passwords page): a blank password on the edit form touches profile details only; setting a new password signs that user out of their sessions.
Revoke sessions individually: each of a user’s active sign-ins can be revoked from their edit screen.

Safeguards against lockout

Several mistakes are deliberately made impossible:

You can’t demote yourself from admin to editor while you’re the only active admin; the attempt is refused with a clear message before the change is saved.
You can’t delete or suspend your own account.
You can’t delete or bulk-delete the last remaining user account.

Profile and session control (every account)

Every user, regardless of role, gets an account page where they can:

Change their password (requiring the current one; see Passwords).
Update their display name, timezone, and avatar.
Use “sign out all other devices,” which invalidates every session except the one in use.

Everything admins do here is recorded in the audit log: who changed what, for which user, and when.