Skip to content

Sharing and Access Control

Jump to bottom
Valerio edited this page Apr 27, 2026 · 1 revision

Sharing and Access Control

UncannyPrompt combines tenant membership with explicit ACL grants. Membership establishes baseline access to the tenant. Grants allow more precise access to projects, folders, and prompts.

Access layers

Authenticated user
  -> TenantMembership
  -> ApplicationPermission
  -> ShareGrant, if resource-specific access is needed
  -> AccessControlQueries, applied in SQL

Tenant membership

TenantMembership links a User to a Tenant with a TenantRole. Tenant roles are mapped to application-level permissions by PermissionService.

This keeps controller code from hardcoding role names. Controllers and pages call services; services ask the permission layer.

Application permissions

ApplicationPermission models concrete capabilities such as prompt editing, sharing, publishing, version restore, role management, export, and audit viewing.

This exists because simple share levels such as View, Edit, and Manage are not expressive enough for every product action.

Share grants

ShareGrant has a target type:

Target Access semantics
Project Access to the project and resources beneath it
Folder Access to the folder subtree and contained prompts
Prompt Access to one prompt

Grant lifecycle fields such as expiration, revocation, and soft-delete must be honored by every access check.

Inheritance

Access checks are hierarchical:

  • A project grant can cover folders and prompts inside that project.
  • A folder grant can cover child folders and prompts below it.
  • A prompt grant can grant access even without project-wide access.

TenantScopeService exposes project, folder, and prompt checks. Listing code should prefer AccessControlQueries so authorization runs in SQL.

Public links

Public links are anonymous access paths to specific prompts. They are not general ACL grants.

Validation requires:

  • a syntactically valid token;
  • a TokenLookupHash match;
  • verification against TokenHash;
  • no soft-delete;
  • no revocation;
  • no expiration.

Successful public access is audited.

UI and API entry points

Entry point Purpose
SharesController manage share grants
PublicLinksController create/revoke/list public links
PublicPrompt.cshtml anonymous public prompt view
Shares.cshtml sharing management UI
Settings.cshtml tenant/user settings surface
Audit.cshtml audit review

Source pointers

Clone this wiki locally