Assigning a role to a user in SourceCraft

Access to SourceCraft is controlled by issuing permissions to users in organizations and repositories.

You can assign roles to users at the organization or particular repository level.

You can specify an organization-level role for a new user in the invitation.

Assigning a role to a user in an organization

Warning

You need at least the Organization admin role to assign a role to an organization user.

  1. Open the SourceCraft home page.
  2. On the Home tab, navigate to Organizations.
  3. Select the organization you want to assign a role in.
  4. On the organization page, under  People, go to the  Members & roles section.
  5. Next to the user you want to assign the role to, click in the Members & roles column.
  6. Mark the roles you want to assign to the user with .
  7. Click Apply.

Tip

You can assign roles in the organization directly to a user group. For more information, see {#T}.

Assigning a role to a user in a repository

Warning

You need at least the Repository maintainer role to assign a role to a repository user.

When you assign a role in a repository to a user who is not a member of the organization owning the repository, the user will be invited to the organization. In which case you will need the Organization admin role.

  1. Open the SourceCraft home page.

  2. On the Home tab, under Your craftspace, navigate to Repositories.

  3. Select the repository you want to assign a role in.

  4. Under  Repository settings on the repository page, go to  Members & roles.

  5. In the top-right corner, click New role.

  6. In the window that opens, select the principle of issuing an invitation and a role to the user:

    1. In the Users or teams field, start typing the user's public name, e.g., John Smith, or nickname, e.g., jsmith-2000, and select the user from among the suggested options.
    2. In the Role drop-down list, select the role you want to assign.
    3. In the Invite Expires In drop-down list, select how long the invitation to the repository will remain valid.
    4. Click Add.
    1. In the Emails field, enter the email addresses of the users you want to assign the role to, one by one.
    2. In the Role drop-down list, select the role you want to assign.
    3. In the Invite Expires In drop-down list, select how long the invitation to the repository will remain valid.
    4. Click Add.

    You can generate unique invitation links for ad-hoc users. Each link has its own expiration date and can only be used once.

    This is useful if you do not know the logins or emails of your users or want to automate role assignment and repository access management.

    A user accepts the invitation by clicking the link and gets access to your organization and its repositories.

    The user will also get the role you specify.

    To generate invitation links:

    1. In the Invite Expires In drop-down list, select how long the link will remain valid.

    2. In the Quantity field, specify the number of unique invitation links.

    3. Optionally, in the Prefix field, specify a prefix for the invitation links, e.g., team-sourcecraft.

    4. In the Role drop-down list, select the role that will be assigned to the users who accept the invitation via the link.

    5. Click Add.

    6. In the window that opens, copy the links to the clipboard or download them as a file, then close the window.

      Warning

      After closing the window, the links you generated will no longer be available. However, you can create new ones.

    7. Send the invitation links to the users you want to assign the role to.

    You can generate a single multi-use link that allows one or more users to join the repository. You can create a multi-use link either for specific or ad-hoc users.

    Users joining through the multi-use link will also get the role you specify.

    Multi-invite links are managed via a Yandex Identity and Access Management service account with the organization-manager.passportUserAdmin role. You can select an existing service account or create a new one.

    To generate a multi-use link:

    1. In the Invite Expires In drop-down list, select how long the multi-use link will remain valid.

    2. Optionally, in the Invitee limit field, specify the maximum number of users who can accept this multi-use link. For an unlimited number of users, leave this field empty.

    3. Optionally, in the Unique invite link name field, enter a unique name for the multi-use link. Leave this field empty to generate a name automatically.

    4. In the Role drop-down list, select a role for the users you invite.

    5. Under Can accept, select an invitation limit:

      • Everyone: Any user can accept the invitation.
      • Specific users: Only specific users can accept the invitation:
        • SourceCraft users (optional): Start typing the public name, e.g., John Smith, or nickname, e.g., jsmith-2000, and select one of the suggested options. You can add multiple users.
        • Yandex logins (optional): Enter a user login and click Add login. You can add multiple users.

    6. Under Service account, select one of the following options:

      • Auto: Yandex Cloud will automatically create a new service account with the organization-manager.passportUserAdmin role.
      • Choose existing: Select a Yandex Identity and Access Management service account to use for creating invites.

    7. Click Add.

    8. In the window that opens, copy the multi-use link to the clipboard, then close the window.

      Warning

      After you close the window, the multi-use link you generated will no longer be available. However, you can create a new one.

    9. Send the multi-use link to the users you want to assign the role to.

Tip

You can assign roles in a repository to a whole group of users. For more information, see {#T}.

Assigning a role in a repository to a user via the API

You can automate role assignment using the SourceCraft REST API.

For example, you can integrate role assignment into your website or access management system.

For more information, see Repository | Roles.

To assign a role to a user:

  1. Get a personal access token (PAT).

  2. Run queries depending on whether the user is a member of the organization.

    1. Get user ID in SourceCraft.

      export PAT=<personal_access_token>
curl \
  --request GET \
  --url "https://api.sourcecraft.tech/users/<user_slug>" \
  --header "Authorization: Bearer $PAT" | jq -r '.id'

      Result:

      "01971bf5-676b-79a3-adbf-7644********"

      For more information, see GetProfile.

    2. Assign a role to the user:

      export PAT=<personal_access_token>
curl \
  --request POST \
  --url "https://api.sourcecraft.tech/repos/<organization_slug>/<repository_slug>/roles" \
  --header "Authorization: Bearer $PAT" \
  --header "Content-Type: application/json" \
  --data '{
    "subject_roles": [
      {
        "role": "<role>",
        "subject": {
          "type": "user",
          "id": "<user_ID_in_SourceCraft>"
        }
      }
    ]
  }' | jq

      For possible role values, see Repository | Roles.

      Result:

      {
  "subject_roles": [
    {
      "role": "admin",
      "subject": {
        "type": "user",
        "id": "01971bf5-673f-7c64-a88a-509b********"
      }
    },
    {
      "role": "viewer",
      "subject": {
        "type": "user",
        "id": "01971bf5-676b-79a3-adbf-7644********"
      }
    }
  ],
  "next_page_token": ""
}

      For more information, see Repository | Roles.

    1. Invite the user to the organization.

    2. Get the invitation creation operation info. Use this info to find the organization user ID (the response: invites: subject: id field).

    3. Assign a role to the user:

      export PAT=<personal_access_token>
curl \
  --request POST \
  --url "https://api.sourcecraft.tech/repos/<organization_slug>/<repository_slug>/roles" \
  --header "Authorization: Bearer $PAT" \
  --header "Content-Type: application/json" \
  --data '{
    "subject_roles": [
      {
        "role": "<role>",
        "subject": {
          "type": "invitee",
          "id": "<user_ID_in_organization>"
        }
      }
    ]
  }' | jq

      For possible role values, see Repository | Roles.

      Result:

      {
  "subject_roles": [
    {
      "role": "admin",
      "subject": {
        "type": "user",
        "id": "01971bf5-673f-7c64-a88a-509b********"
      }
    },
    {
      "role": "viewer",
      "subject": {
        "type": "invitee",
        "id": "ajeth710l8gi********"
      }
    }
  ],
  "next_page_token": ""
}

      For more information, see Repository | Roles.

Useful links

Previous
Sending and accepting an invitation to an organization
Next
Working with teams