Skip to main content

Teams and Role-Based Access Control (RBAC)

The Teams page (/teams, source code at src/app/teams/page.tsx) enables tenant administrators to manage organizational collaborators, configure granular RBAC permission profiles, and supervise authentication compliance (MFA status, last login timestamps).

TkushPatch's access control architecture is anchored in the principle of least privilege and natively embeds the separation of responsibilities required in high-assurance environments.

1. Overview of the 5 Platform Roles​

Every invited team member is assigned one of five strictly enforced RBAC roles:

RBAC RoleCommon TitleFunctional ScopePrimary Restrictions
ROLE_ADMINSuper Administrator / Tenant OwnerFull tenant control, subscription management, member lifecycle, global policy configuration, and signing key provisioning.Cannot self-approve patches when strict multi-member mode is active.
ROLE_RELEASE_DEVELOPERMobile Lead Developer (Maker)Multi-ABI Store release creation, OTA patch crafting, dynamic asset uploads, Dart symbol archiving, and L3 device support.❌ Prohibited from cryptographic signing (/approvals), canary rollouts (/rollout), and audit logs (/audit).
ROLE_SECURITY_OFFICERSecurity Officer (Checker / CISO)Four-Eyes approval gates, cryptographic signing engine signing operations, channel promotions, and regulatory compliance audits.❌ Prohibited from managing assets, canary rollout percentages, or server infrastructure.
ROLE_SRE_ADMINSRE / Infrastructure EngineerProgressive Canary rollout percentages, country geo-targeting, emergency Kill-Switch triggers, and Day-2 binary disk purges.❌ Prohibited from signing code or inviting new organizational members.
ROLE_AUDITOR_READONLYRegulatory Compliance AuditorRead-only inspection of high-level dashboards, certified audit logs, and operational telemetry streams.❌ All mutation buttons and action endpoints are hidden and rejected by the API layer.

2. Collaborator Account Lifecycle​

Team member management conforms to three standard statuses:

Team Member Lifecycle States
  • INVITED: Invitation sent via email with assigned role (Admin, Developer, Auditor).
  • ACTIVE: Account configured with credentials and optional multi-factor authentication.
  • SUSPENDED: Access revoked by an administrator due to departures or security review.

Status Details​

  • INVITED: The invitation email has been sent. The one-time setup token remains valid for 48 hours.
  • ACTIVE: The user has authenticated, established their credentials, and verified their initial 2FA OTP challenge.
  • SUSPENDED: Access to both the web console and administrative API endpoints is instantly revoked without altering historical audit trails.

3. Inviting a New Team Member​

Only users possessing the ROLE_ADMIN authority are permitted to invite new members.

  1. Navigate to /teams.
  2. Click Invite Collaborator.
  3. Provide the member's professional email address.
  4. Select the appropriate role from the 5 available options.
  5. Click Send Invitation (POST /api/admin/v1/teams/invite).

The invited user receives an automated email containing a single-use token pointing to the onboarding screen (/register?token=...).

4. Multi-Factor Authentication (MFA) Oversight and Resets​

Banking-grade security standards require mandatory secondary authentication (2FA OTP) across the Control Plane.

In the /teams roster:

  • A green 2FA Active badge indicates that the user must pass an OTP challenge upon each login.
  • An amber 2FA Pending badge flags an account whose initial OTP enrollment remains incomplete.

2FA Reset Procedure (Lost Device or Mailbox Access)​

If a team member loses access to their verification channel:

  1. An administrator clicks the context menu on the user's row.
  2. Selects Reset 2FA Factor.
  3. Confirms the administrative password to prevent unauthorized account resets.
  4. An immutable audit record is immediately committed (audit_action: USER_MFA_RESET).
  5. On subsequent login, the user is required to complete fresh OTP onboarding.

5. Instant Revocation and Audit Trail Integrity​

When offboarding collaborators or adjusting authorization boundaries:

  • Instant Token Revocation: Clicking Suspend terminates all active JWT tokens for that user ID at the server level.
  • CLI Session Teardown: Any active CLI credentials authorized via tk-ota-push login are immediately invalidated upon web account suspension.
  • Audit Immutability: Historical actions performed by the collaborator (such as past approvals or release declarations) remain permanently preserved in the audit log under their original identity.