Roles

Roles

Roles restrict what a user can do inside a group. A role is a single byte (0–127) interpreted as 7 bits: each bit enables one action.

Permission bits

Bit	Value	Action	Description
0	1	Read	Read the group's messages
1	2	Write	Send messages to the group
2	4	Add user	Add users to the group
3	8	Update roles	Change other users' roles
4	16	Delete user	Remove users from the group
5	32	Update group	Rename the group
6	64	Delete group	Delete the group

Bits combine additively — the role value is the sum of the enabled bits.

Notable values

Value	Meaning
0	No permissions beyond membership (cannot even read messages)
3	Read + write (default when a user is added to a group)
127	Full control (1+2+4+8+16+32+64), same power as the creator

• The group creator is always set to 127.
• A user added with POST /group/{id} without the roles parameter gets 3.
• Values outside 0–127 are rejected by RoleModel and fall back to 3.

Endpoints and required bits

Endpoint	Needs bit
GET /messages/{id}	0 (read)
POST /send/{id}	1 (write)
POST /group/{id}	2 (add)
PUT /group/{id}/{name}	3 (update roles)
DELETE /group/{id}/{name}	4 (delete user)
PUT /group/{id}	5 (update group)
DELETE /group/{id}	6 (delete group)
GET /groups, GET /group/{id}, DELETE /exit/{id}	membership only, no bit

Checking a bit in code

RoleModel.isBitOn((byte) 1, roleByte);   // can the user write?

Example

A moderator who can read, write and remove users but not delete the group:

read(1) + write(2) + delete user(16) = 19

# grant role 19 to bob in group 3 (requires bit 3 on the caller's role)
curl -X PUT -H "Authorization: $TOKEN" \
  -F 'roles=19' "http://localhost:8080/group/3/bob"