Repository navigation
EN Editor Remote and Team
English · Türkçe · Languages / Diller
Scope: JSON API Forge 0.5.1 · Source review: 17 September 2026 · Language: English
The control-plane prefix is /__forge/editor/v1; it is not registered when EDITOR_API_ENABLED=false. Application API keys/JWTs and operator tokens do not log into this surface.
For a new deployment:
forge init --editor --production
forge migrateFor an existing .env, first read the CLI init behavior. Adapt settings to your actual topology:
EDITOR_API_ENABLED=true
EDITOR_SETUP_ENABLED=true
EDITOR_REQUIRE_HTTPS=true
EDITOR_ALLOWED_IPS=10.20.0.0/16
EDITOR_TRUSTED_PROXY_CIDRS=127.0.0.1/32
EDITOR_TRUSTED_HOSTS=forge-admin.example.com
EDITOR_LEGACY_TOKEN_ENABLED=false
EDITOR_ALLOW_CREATE_PROJECTS=false
EDITOR_ALLOW_HOOKS=false
EDITOR_ALLOW_GRAPHS=true
EDITOR_ALLOWED_PROJECTS=WikiDemoThe sample CIDRs are placeholders. Use your real VPN/client and reverse-proxy ranges. forge init --editor generates the strong EDITOR_TOKEN used as a one-time setup secret.
In File → Connect to server…, complete founder setup once. Then set EDITOR_SETUP_ENABLED=false, remove EDITOR_TOKEN from the environment and restart workers. Use individual accounts and expiring invitations afterward.
| Role | Rank | General purpose |
|---|---|---|
| Founder | 1000 | Protected founder account |
| Administrator | 800 | Broad administration, still subject to higher-rank constraints |
| Developer | 600 | Project/config/graph work and declared-database reads |
| Analyst | 400 | Document/data reading and selected collaboration |
| Collaborator | 200 | Documents and team communication; no DB scope |
| Viewer | 100 | Limited reading; DB metadata permission, not row reads |
The control-plane reference lists exact built-in permissions from code. Role names alone are not permission specifications. Users may hold multiple global/project memberships; permissions and scopes are evaluated together.
Administrators cannot create equal/higher-ranked roles, delegate permissions they lack or broaden scopes beyond their own authority. Document deny rules survive delegation. The remote API does not disable or reassign the founder. Built-in roles are immutable; create suitable lower-ranked custom roles instead.
The allowlist covers app.json, direct config/*.json, and explicitly enabled graphs/*.forgegraph.json and hooks/*.py. .env, arbitrary source paths, traversal and symlinks are rejected.
Saving requires the current SHA-256 revision. The server acquires process/file locks, stages allowlisted documents, validates the full project, fsyncs a temporary file and replaces atomically. Locks coordinate workers sharing a filesystem; separate hosts need their own configuration coordination design.
EDITOR_READ_ONLY blocks writes even when roles grant them. Hooks require both EDITOR_ALLOW_HOOKS and documents.hooks.write; graphs have separate policy and permission. Hook-writing authority permits code execution with the process account's privileges.
Integrations → Server team workspace includes profiles, roles, memberships, project areas, messages/announcements, notes, attachments, database browsing, calls and audit. Open areas are visible to authorized project members; restricted areas enforce rank/role conditions. Private notes are not public project notes.
The DB browser does not accept raw SQL. It uses declared resources, readable/hidden-field policies and bounded SELECT pagination. Undeclared-table access requires both the server switch and databases.undeclared.read.
Attachments use random storage names outside the public web root and are downloaded through authorized endpoints. A private-looking path does not replace authentication.
WebRTC carries media peer-to-peer with DTLS-SRTP. Forge provides bounded signaling and does not record audio/video. Provision TURN separately where relaying is required. TURN credentials reach authorized participants' browsers; prefer short-lived, narrowly scoped credentials.
The Editor uses an off-the-record Qt WebEngine profile when available, otherwise the system browser. Tickets are short-lived and single-use, moving from URL fragment to WebSocket subprotocol. Native ASGI/WSS is required. Session defaults are a 12-hour absolute lifetime and a 1-hour idle timeout; disabling a member revokes their sessions.
This page describes the behavior at the pinned commits below. Recheck these contracts when upgrading.
main/framework/editor_api.pymain/framework/editor_identity.pymain/framework/editor_database.pymain/framework/settings.pyEditor/editor/src/TeamWorkspace.cpp