Skip to content
CCS Chat Docs

Grant permissions to roles

Goal

Section titled “Goal”

Give the roles of your Tenant application (for example coach and client) the Chat permissions they need inside existing conversations, and nothing that lets them start conversations on their own. Your backend then stays in control of who talks to whom.

Prerequisites

Section titled “Prerequisites”
Chat permission: administration.manage
  • You are the tenant owner, or an admin whose role holds administration.manage (the owner grants it to tenant_admin first).
  • Chat is switched on for your application, and your application roles exist and are assigned to users in the Identity Server.

Steps

Section titled “Steps”

  1. Open Chat Administration. Sign in to Chat at chat.centralcodestation.com, choose your workspace (your tenant), and open Administration, then Roles & permissions.

  2. Pick your application. In the Where list, choose Chat inside your application, for example “Fitness”. The tenant roles and your application roles (coach, client) are listed.

  3. Grant the backend-driven set. Every role starts with no permissions here, independently of the tenant-wide mapping. For coach and for client, tick the four permissions below and select Save on each role.

  4. Wait a minute. Changes apply to members within about a minute.

The backend-driven grant set

Section titled “The backend-driven grant set”
Role Chat permissions inside Fitness
coach conversations.read, messages.read, messages.send, messages.update
client conversations.read, messages.read, messages.send, messages.update
Permission What it lets the user do
conversations.read List and open the conversations they are in, and PUBLIC channels
messages.read Read messages. Also needed for reactions, read state and typing
messages.send Send messages, replies and mentions
messages.update Edit their own messages

Why three permissions are left out

Section titled “Why three permissions are left out”

A permission applies to every holder of the role. It says which kind of operation a user may perform, never with whom.

  • conversations.create would let any coach open a chat with any tenant member who can use the application. That is the rule your backend exists to enforce.
  • groups.create also lets a group owner add members to the group, so membership would no longer follow your rules. Leave it out if your backend manages group membership.
  • users.lookup lets a user search for other members. Without it, users cannot browse your member list.

Users do not need any of these to take part in a conversation someone else created for them. Your backend creates it with its backend client, and Chat checks membership on every call.

Verify

Section titled “Verify”

Ask Chat what a user may do. Use a Chat token of a user who holds the coach role (see Issue Chat tokens to your users).

const { roles, capabilities } = await chat.capabilities(); // chat is a ChatUserClient

Troubleshooting

Section titled “Troubleshooting”
Symptom Cause and fix
403 missing_capability The role lacks the permission the call needs. The message names it. Grant it inside the application, not tenant-wide.
A user sees no conversations The role lacks conversations.read, or your backend has not created a conversation with them yet.
The role shows no permissions Each context is its own mapping. Check that Where is set to your application.
Saving the role fails with role_locked tenant_owner cannot be changed.
A change does not show yet It applies within about a minute.
Section titled “Related”