Console
ScalWS Console: roles and capabilities
Roles are fixed sets of capabilities (cmd/scalws-console/src/rbac.rs). Every API handler
names the capability it needs and checks it on the server; the browser only hides what the
session cannot do. Sensitive actions also need a password confirmation within the last
5 minutes (re-authentication).
| Capability | What it allows | Viewer | Developer | Operator | Administrator |
|---|---|---|---|---|---|
server.read | Overview, Traffic (live statistics), Adaptive Runtime, Listeners, About | yes | yes | yes | yes |
config.read | current configuration, history, drafts, operations (secrets redacted) | yes | yes | yes | yes |
config.draft | create, edit, validate, diff and discard own drafts | yes | yes | yes | |
config.apply | apply a draft as a new generation (re-auth) | yes | yes | ||
config.rollback | restore a history entry as a new generation (re-auth) | yes | yes | ||
runtime.manage | desired instance count, autoscaling mode, run-time tenant limits | yes | yes | ||
cache.purge | purge cached responses on every instance (re-auth) | yes | yes | ||
logs.read | controller log | yes | yes | yes | |
audit.read | audit log | yes | yes | ||
users.read | list console accounts | yes |
Draft ownership: a draft can be edited, applied or discarded by its owner or an
administrator; others with config.read can view it.
Accounts are managed in the credentials file on the server (docs/console-operations.md);
there is no account editing in the browser, so there is no users.manage capability yet.
Control → capability → backing (capability matrix)
Every control in the UI and what implements it. Unsupported controls are not shown.
| UI control | Capability | Backed by | Shown |
|---|---|---|---|
| Health strip, instance table, decision explanation, distribution | server.read | controller GET /status | yes |
| Listener sockets and generations, QUIC demux | server.read | status.listeners, status.quic | yes |
| Desired instances | runtime.manage | POST /scale/N (within instances.min..max) | yes |
| Autoscaling mode | runtime.manage | POST /autoscaling/MODE | yes |
| Tenant usage (CPU, memory, I/O) | server.read | controller GET /tenants/usage | yes |
Tenant limits at run time (audited as tenant.limits) | runtime.manage | controller POST /tenants/{t}/limits | yes |
| Cache purge | cache.purge | POST /cache/purge | API only (no page yet) |
| Live traffic (per site, listener, instance, method; latency, errors, bandwidth) | server.read | instance /metrics, aggregated by the console | yes |
| Settings pages for every field of scalws.yaml | config.draft | JSON Schema of the config structs (scalws-config, feature schema) | yes |
| Settings pages for controller.yaml | config.draft | scalws-controller config-schema / check-config | yes |
| Raw configuration editor | config.draft | draft in console memory | yes |
| Validate | config.draft | scalws-config + scalwsd --check | yes |
| Apply | config.apply | file transaction + POST /reload + health check | yes |
| Restore from history | config.rollback | same transaction | yes |
| Logs | logs.read | controller log file (--controller-log) | yes |
| Audit log | audit.read | audit.jsonl | yes |
| Drain / restart one instance | no controller endpoint | no | |
| Apply controller.yaml | config.apply | file transaction + --controller-restart-command + settle check | yes |
| Per-domain or per-HTTP-version counts | not reported by the data plane (proposal in console-architecture.md) | no | |
| Certificate upload / renewal | none (paths in the configuration; ACME automatic) | no | |
| Account management | credentials file | read-only (About) |
Future scopes
Capabilities are global today. The model leaves room for a scope (tenant or site) per
grant: sites.manage@tenant-a. Drafts already carry an owner; per-tenant drafts would add
a scope check on save and apply.