Users, casinos and roles
The membership model
Users and casinos are many-to-many. One operator can hold access to several casinos with a different role in each.
The role lives on the link, not on the user, so someone can be owner of one casino and
viewer of another.
The three roles
| Role | Can |
|---|---|
owner | Everything, including membership and API keys |
admin | Operate the casino, but cannot change membership |
viewer | Read only |
Permissions
Roles are a table, holding roles, permissions and the grants between them, so a role's permission set is editable. The catalog:
| Read | Write |
|---|---|
battles.read | battles.write |
games.read | games.write |
users.read | users.write |
tenants.read | tenants.write |
roles.read | roles.write |
settings.read | settings.write |
apikeys.read | apikeys.write · menu.write |
apikeys.* is a pair of its own rather than part of tenants.*: renaming a casino and
minting the credential its backend authenticates with are not the same act. Admin gets the
read half; owner gets both.
Not the name, and not the key.
tenant_users.role stores the role's key, so renaming a system role's key would de-authorise
every membership holding it. Everyone with that role would stop matching, and nothing would
report an error. Refusing the key makes that unrepresentable.
Super-user
A super-user holds every permission in every casino, and is the only actor who can reach platform-scoped resources: the viewer signing key and the lobby windows.
The console does not branch on super-user for ordinary routes. A super-user's role is reported
as owner, and owner holds everything, so a second branch per handler would be duplicate
logic that could drift.
Adding an operator
From the console, Users → Add. The invitee gets an account linked to the active casino with
the role you choose.
The first operator for your casino cannot be created this way, because there is no registration route. That account is created for you by the platform when they onboard you, and every operator after it is invited from the console.
Suspending
Suspending a user blocks their sign-in.
Suspending a casino makes every S2S request from it answer 403 tenant suspended, a
specific answer rather than a generic denial, because the caller is legitimate and needs to
know to stop retrying.
Casino ids are permanent in practice
The id appears in events, webhooks, audit records and every casino's own logs. It is a stable slug you will not want to rename, so choose it at creation with that in mind.