For AI agents: the documentation index is at /docs/aidbox/llms.txt. A Markdown version of this page is available at /docs/aidbox/notebooks.md or by requesting it with the Accept: text/markdown header.
Aidbox Docs
All notebooks

New user role and feature access

Follow this workflow to assign role and enable access for new user

8 cells · updated Aug 2, 2022

Run in Aidbox
This is a read-only view. Responses shown were saved when the notebook was published — open it in your own Aidbox to run the cells against live data.

Prerequisites

  • Aidbox user needs to be created with reference to existing system account
  • Client administrator role needs to exist with prepared feature permission set
  • Organization must exist and it has to belong to same system account

Step 1

Check current role and feature access asignment for all users

Reccomended first step to detect possible duplicate entries in the feature bindings table

SQL Send Cells run only inside Aidbox. Use Run in Aidbox above to open this notebook in your own instance. 
select
  rolebinding.resource -> 'user' as admin,
  rolebinding.resource -> 'organization' as organization,
  jsonb_agg(distinct role.resource || jsonb_build_object('id', role.id)) as roles,
  feature.resource -> 'name' as feature,  
  featurebinding.resource -> 'permissions' as permissions
from role
join rolebinding on role.id = rolebinding.resource #>> '{role, id}'
join featurebinding on role.id = featurebinding.resource #>> '{role, id}'
join feature on feature.id = featurebinding.resource #>> '{feature, id}'
group by admin, organization, feature, permissions
Result
adminrolesfeaturepermissionsorganization
{"id": "25a53a28-f267-46d0-b841-6729b589edcf", "resourceType": "User"}[{"id": "organization-admin", "name": "Organization admin"}]"Broadcast campaign"["read"]{"id": "acme", "resourceType": "Organization"}
{"id": "25a53a28-f267-46d0-b841-6729b589edcf", "resourceType": "User"}[{"id": "organization-admin", "name": "Organization admin"}]"Broadcast campaign"["read", "write"]{"id": "acme", "resourceType": "Organization"}
{"id": "25a53a28-f267-46d0-b841-6729b589edcf", "resourceType": "User"}[{"id": "organization-admin", "name": "Organization admin"}]"General campaigns: reminder, notification, no show, alert"["read", "write"]{"id": "acme", "resourceType": "Organization"}

Step 2

Check current role and feature access asignment for created user

For this you will need an ID of created user to use instead of USER_ID_HERE below

SQL Send Cells run only inside Aidbox. Use Run in Aidbox above to open this notebook in your own instance. 
select
  rolebinding.resource -> 'user' as admin,
  rolebinding.resource -> 'organization' as organization,
  jsonb_agg(distinct role.resource || jsonb_build_object('id', role.id)) as roles,
  feature.resource -> 'name' as feature,  
  featurebinding.resource -> 'permissions' as permissions
from role
join rolebinding on role.id = rolebinding.resource #>> '{role, id}'
join featurebinding on role.id = featurebinding.resource #>> '{role, id}'
join feature on feature.id = featurebinding.resource #>> '{feature, id}'
where rolebinding.resource #>> '{user, id}' = 'USER_ID_HERE'
group by admin, organization, feature, permissions
Result
adminrolesfeaturepermissionsorganization
{"id": "25a53a28-f267-46d0-b841-6729b589edcf", "resourceType": "User"}[{"id": "organization-admin", "name": "Organization admin"}]"Broadcast campaign"["read"]{"id": "acme", "resourceType": "Organization"}
{"id": "25a53a28-f267-46d0-b841-6729b589edcf", "resourceType": "User"}[{"id": "organization-admin", "name": "Organization admin"}]"Broadcast campaign"["read", "write"]{"id": "acme", "resourceType": "Organization"}
{"id": "25a53a28-f267-46d0-b841-6729b589edcf", "resourceType": "User"}[{"id": "organization-admin", "name": "Organization admin"}]"General campaigns: reminder, notification, no show, alert"["read", "write"]{"id": "acme", "resourceType": "Organization"}

Step 3

Assign organization-admin role for appropriate organization to the user

For this you will need an ID of created user to use instead of USER_ID_HERE below and ID of organization to use instead of ORG_ID_HERE below

REST Send Cells run only inside Aidbox. Use Run in Aidbox above to open this notebook in your own instance. 
POST /RoleBinding

{
	"role": {
    	"id": "organization-admin",
    	"resourceType": "Role"
    },
    "organization": {
    	"id": "ORG_ID_HERE",
    	"resourceType": "Organization"
    },
    "user": {
    	"id": "USER_ID_HERE",
    	"resourceType": "User"
    }
}

Step 4

Go to step 2 and check again