Assigning a role to a user in SourceCraft

Access to SourceCraft is controlled by issuing permissions to users in organizations and repositories.

You can assign roles to users at the organization, project, or individual repository level.

You can specify an organization-level role for a new user in the invitation.

Assigning a role to a user in an organization

Warning

You need at least the Organization admin role to assign a role to an organization user.

  1. Open the SourceCraft home page.
  2. On the Home tab, navigate to Organizations.
  3. Select the organization you want to assign a role in.
  4. On the organization page, under  People, go to the  Members & roles section.
  5. Next to the user you want to assign the role to, click in the Members & roles column.
  6. Mark the roles you want to assign to the user with .
  7. Click Apply.

Tip

You can assign roles in the organization directly to a user group. For more information, see {#T}.

Assigning a project-level role to a user

Note

To assign or delete user roles in a project, you need the Project maintainer role or higher at the project or organization level.

Roles assigned to a user in a project apply to all repositories in the project.

  1. Open the SourceCraft home page.

  2. On the Home tab, navigate to Organizations and select an organization.

  3. In the Your craftspace section, navigate to Projects.

  4. To the right of the project, click and go to Members & roles.

  5. In the top-right corner, click Add member.

  6. Select a user and their role in the project.

    Warning

    You can add to the project only users who are members of the organization.

  7. Click Add.

Assigning a role to a user in a repository

Warning

You need at least the Repository maintainer role to assign a role to a repository user.

When you assign a role in a repository to a user who is not a member of the organization owning the repository, the user will be invited to the organization. In which case you will need the Organization admin role.

  1. Open the SourceCraft home page.

  2. On the Home tab, under Your craftspace, navigate to Repositories.

  3. Select the repository you want to assign a role in.

  4. Under  Repository settings on the repository page, go to  Members & roles.

  5. In the top-right corner, click New role.

  6. In the window that opens, select the principle of issuing an invitation and a role to the user:

    1. In the Users or teams field, start typing the user's public name, e.g., John Smith, or nickname, e.g., jsmith-2000, and select the user from among the suggested options.
    2. In the Role drop-down list, select the role you want to assign.
    3. In the Invite Expires In drop-down list, select how long the invitation to the repository will remain valid.
    4. Click Add.
    1. In the Emails field, enter the email addresses of the users you want to assign the role to, one by one.
    2. In the Role drop-down list, select the role you want to assign.
    3. In the Invite Expires In drop-down list, select how long the invitation to the repository will remain valid.
    4. Click Add.

    You can generate unique invitation links for ad-hoc users. Each link has its own expiration date and can only be used once.

    This is useful if you do not know the logins or emails of your users or want to automate role assignment and repository access management.

    A user accepts the invitation by clicking the link and gets access to your organization and its repositories.

    The user will also get the role you specify.

    To generate invitation links:

    1. In the Invite Expires In drop-down list, select how long the link will remain valid.

    2. In the Quantity field, specify the number of unique invitation links.

    3. Optionally, in the Prefix field, specify a prefix for the invitation links, e.g., team-sourcecraft.

    4. In the Role drop-down list, select the role that will be assigned to the users who accept the invitation via the link.

    5. Click Add.

    6. In the window that opens, copy the links to the clipboard or download them as a file, then close the window.

      Warning

      After closing the window, the links you generated will no longer be available. However, you can create new ones.

    7. Send the invitation links to the users you want to assign the role to.

    You can generate a single multi-invite link that allows one or more users to join the repository. You can create a multi-invite link either for specific users or for anyone with the link.

    Users joining through the multi-invite link will also get the role you specify.

    Multi-invite links are managed via a Yandex Identity and Access Management service account with the organization-manager.passportUserAdmin role. You can select an existing service account or create a new one.

    To generate a multi-invite link:

    1. In the Invite Expires In drop-down list, select how long the multi-invite link will remain valid.

    2. Optionally, in the Invitee limit field, specify the maximum number of users who can accept your multi-invite link. For an unlimited number of users, leave this field empty.

    3. Optionally, in the Unique invite link name field, enter a unique name for the multi-invite link. Leave this field empty to generate a name automatically.

    4. In the Role drop-down list, select a role for the users you invite.

    5. Under Can accept, select an invitation restriction:

      • Everyone: Any user can accept the invitation.
      • Specific users: Only specific users can accept the invitation:
        • SourceCraft users: Start typing a public name, e.g., John Smith, or nickname, e.g., jsmith-2000, and select one of the suggested options. This is an optional setting. You can add multiple users.
        • Yandex logins: Enter a user login and click Add login. This is an optional setting. You can add multiple users.

    6. Under Service account, select one of the following options:

      • Auto: Yandex Cloud will automatically create a new service account with the organization-manager.passportUserAdmin role.
      • Choose existing: Select a Yandex Identity and Access Management service account to use for creating invitations.

    7. Click Add.

    8. In the window that opens, copy the multi-invite link to the clipboard, then close the window.

      Warning

      After you close the window, the multi-invite link you generated will no longer be available. However, you can create a new one.

    9. Send the multi-invite link to the users you want to assign the role to.

Tip

You can assign roles in a repository to a whole group of users. For more information, see {#T}.

Assigning a role in a repository to a user via the API

You can automate role assignment using the SourceCraft REST API.

For example, you can integrate role assignment into your website or access management system.

For more information, see Repository | Roles.

To assign a role to a user:

  1. Get a personal access token (PAT).

  2. Run queries depending on whether the user is a member of the organization.

    1. Get user ID in SourceCraft.

      export PAT=<personal_access_token>
curl \
  --request GET \
  --url "https://api.sourcecraft.tech/users/<user_slug>" \
  --header "Authorization: Bearer $PAT" | jq -r '.id'

      Result:

      "01971bf5-676b-79a3-adbf-7644********"

      For more information, see GetProfile.

    2. Assign a role to the user:

      export PAT=<personal_access_token>
curl \
  --request POST \
  --url "https://api.sourcecraft.tech/repos/<organization_slug>/<repository_slug>/roles" \
  --header "Authorization: Bearer $PAT" \
  --header "Content-Type: application/json" \
  --data '{
    "subject_roles": [
      {
        "role": "<role>",
        "subject": {
          "type": "user",
          "id": "<user_ID_in_SourceCraft>"
        }
      }
    ]
  }' | jq

      For possible role values, see Repository | Roles.

      Result:

      {
  "subject_roles": [
    {
      "role": "admin",
      "subject": {
        "type": "user",
        "id": "01971bf5-673f-7c64-a88a-509b********"
      }
    },
    {
      "role": "viewer",
      "subject": {
        "type": "user",
        "id": "01971bf5-676b-79a3-adbf-7644********"
      }
    }
  ],
  "next_page_token": ""
}

      For more information, see Repository | Roles.

    1. Invite the user to the organization.

    2. Get the invitation creation operation info. Use this info to find the organization user ID (the response: invites: subject: id field).

    3. Assign a role to the user:

      export PAT=<personal_access_token>
curl \
  --request POST \
  --url "https://api.sourcecraft.tech/repos/<organization_slug>/<repository_slug>/roles" \
  --header "Authorization: Bearer $PAT" \
  --header "Content-Type: application/json" \
  --data '{
    "subject_roles": [
      {
        "role": "<role>",
        "subject": {
          "type": "invitee",
          "id": "<user_ID_in_organization>"
        }
      }
    ]
  }' | jq

      For possible role values, see Repository | Roles.

      Result:

      {
  "subject_roles": [
    {
      "role": "admin",
      "subject": {
        "type": "user",
        "id": "01971bf5-673f-7c64-a88a-509b********"
      }
    },
    {
      "role": "viewer",
      "subject": {
        "type": "invitee",
        "id": "ajeth710l8gi********"
      }
    }
  ],
  "next_page_token": ""
}

      For more information, see Repository | Roles.

Useful links

Previous
Sending and accepting an invitation to an organization
Next
Working with teams