Jul 14
[Feature Request] Fine-Grained Role Permissions: Separate Control for Settings and Integrations Pages
Background:
The current permission management system is too coarse-grained (often offering only broad "Admin" vs. "Staff" roles). As a result, regular staff who only need basic operational access can inadvertently view or modify critical global configurations on the "Settings" page, or even access sensitive assets on the "Integrations" page (such as API keys, webhooks, and payment configs). This "all-or-nothing" permission structure poses substantial security risks and increases the likelihood of accidental misconfigurations during team collaboration.Proposed Solution:
We propose a refactor of the permission architecture to introduce page-level, fine-grained access control, allowing administrators to delegate permissions independently for core sections:Decoupled Permission Nodes: Within the role/permission management dashboard, split "Global Settings" and "Third-Party Integrations" into two completely independent permission toggles.Tiered Access Levels: Implement three distinct access levels for each specific page/section:No Access: The menu item is hidden from the user's sidebar, and direct URL access returns a "403 Unauthorized" error.Read-Only: Users can enter the page to view current configurations, but all save/edit buttons are disabled. Sensitive data (such as API Keys or Client Secrets) must be masked (e.g., ******).Full Access: Grant full editing, configuring, and management privileges.
Pending