Scoped roles: Members and Viewers only see what they're added to
Permissions that only control editing are a half-measure: a read-only user who can still browse every project in the workspace is a privacy problem waiting for its first incident. Roles in Asire now gate visibility too, enforced on the server.
The four roles
- Owner — full control of the workspace, including deletion and transferring ownership.
- Admin — creates and archives projects, manages members, and can see everything in the workspace.
- Member — works on the projects they've been added to: creating, editing, and completing tasks.
- Viewer — reads the projects they've been added to and comments, but changes nothing.
Enforced where it counts
The important part of this release isn't the UI. Hiding a project from a sidebar is cosmetic; the check has to happen on the server, on every read. Project, task, comment, and attachment access all resolve the caller's workspace role before returning anything, so a hand-crafted request gets the same answer the app does.
Upgrading a Viewer to Member takes effect immediately — no re-invite, no sign-out and back in.
Invitations
Invites carry the role with them. The person you invite lands on an acceptance screen that names the workspace and the role they're accepting, rather than silently joining with whatever default the system felt like.