Organizations, Users & Permissions

Manage tenants, team members, organization structure, and access control. This guide follows version 3.1.7 (03acdf712c).

For sign-in flows, see Authentication. For contributing changes, see Contribute to the Codebase.

Modules

• backend/core-api/src/modules/organization/: team members (team-member/graphql/, db/models/Users.ts), structure (structure/graphql/, branches, departments, units, positions), brands, settings, and routes.ts (/get-frontend-plugins, owner detection).
• backend/core-api/src/modules/auth/: login, password reset, magic link, OAuth client apps (graphql/schemas/auth.ts, db/definitions/oauth*.ts).
• backend/core-api/src/modules/permissions/: RBAC (graphql/schemas/permission.ts, db/models/Permissions.ts, trpc/permission.ts).
• Shared contracts: backend/erxes-api-shared/src/core-modules/permissions/ and backend/erxes-api-shared/src/core-modules/users/-adjacent user definitions.

Users carry branchIds, departmentIds, and positionIds for structure scoping. Brands scope forms and inbox content.

Permissions model

PermissionInput { plugin, module, actions, scope } is checked via checkPermission helpers. Plugins declare their own meta/permissions.ts (for example Sales declares deal, board, pos modules with admin/user/viewer groups). Agent-callable tRPC procedures also reference a registered permission action; see GraphQL & tRPC.

Verify

1. Create an owner on a fresh database via /create-owner and sign in.
2. Create a branch, department, and user, then confirm the user sees only permitted modules.
3. Query the gateway with a team-member token and confirm unauthorized operations fail.

Source references

• Team-member schema.
• Auth schema.
• Permission utils.