Permissions and Supported Actions

Huawei Cloud Astro Zero allows you to use profiles to configure permissions for users. The system provides the following profiles (undeletable):

• System Administrator Profile: grants users full permissions.
• Developer Profile: developer permissions, which are generally assigned to users. Users with this permission can perform development on Huawei Cloud Astro Zero, for example, adding an object, adding a field to an object, and adding a process.
• Portal User Profile: permission is assigned to portal users. Portal users with this permission can log in to Huawei Cloud Astro Zero through service orchestration authentication.
• Anonymous User Profile: access permission of guests. Assign proper permissions to this profile based on service requirements.
• Standard User Profile: permissions for running system flows and creating, viewing, modifying, and deleting records of existing system objects when you enable Huawei Cloud Astro Zero. This profile does not include development permissions. For example, adding an object or process.
• NoCode Developer Profile: grants permission for no-code application development and is preset only in the runtime environment.
• NoCode Manager Profile: grants permission for managing no-code application data and is preset only in the runtime environment.

A profile can be assigned to multiple users, but each user can have only one profile assigned. The following lists the permissions that can be controlled in a profile:

• Basic permissions

  The basic permissions refer to permissions configured on APIs when the built-in resources of Huawei Cloud Astro Zero are operated. The corresponding permission items must be selected on a profile. Otherwise, an error with status code 403 will be reported. For example, to create an object, you must have the application development permissions. To create a user, you must have the user management permissions.

• App and menu display permissions

  Permissions required to display the default application and menu items under the application. This permission control is performed only at the frontend.

• Object and field permissions

  Permissions for users to access field data records of a specific object. Object permissions include:

  • Read: permission to read object instance data. If you do not have this permission, an error message is displayed indicating that you do not have the permission to access object data.
  • Create: permission to create an object instance.
  • Edit: permission to modify object instance data.
  • Delete: permission to delete an object instance.
  • View all: permission to view all instances of an object, regardless of whether the instances belong to OWNER.
  • Modify all: permission to add, delete, or modify all instances of an object, regardless of whether the instances belong to OWNER.
  • API read: permission to initiate a read operation through the HTTP interface, which does not affect the operations initiated in flow and script instances.
  • API write: permission to initiate a write operation through the HTTP interface, which does not affect the operations initiated in flow and script instances.

  Some special objects, such as the User object, cannot be directly accessed. All profiles provide only the read permission. The create, delete, and modify operations must be performed through APIs. Field permissions include:

  • Read: permission to read a field.
  • Write: permission to modify a field.

  Some fields of some objects, such as the password field of the User object, cannot be directly read or modified.

• Display permissions of object standard pages

  Permissions required for displaying the default layout of an object, including the layout of the list, details, creation layout, and editing layout. This permission item applies only to page display.

• API access permissions (flows, scripts, and BPM)

  Permissions required to run Flow, Script, and BPM resources. If you do not have this permission when running a Flow, Script, or BPM resource, an error will be reported. For example, to run the view_product script, ensure that the view_product permission is selected in a profile.

• Connector access permissions

  Permissions required to access only connectors that provide the HTTP interface, including S3, OBS, MINIO, and ObjectStorageProxy connectors.

  To run these connectors, you must check the permissions required for them.

• Event access permissions

  Permissions required only for events that provide HTTP interfaces for external systems, for example, permission to send events of a certain type.

• Service access permissions

  Permissions related to a specific service.