Users and authentication

People and services are principals. Password sessions and raw tokens are credentials for a principal; roles belong to the principal, not to one credential.

Roles

Content roles are hierarchical:

tester and developer can cover all games, one game, or one stream. maintainer can cover all games or one game. A stream assignment covers only that stream, not sibling streams or builds committed without a stream. A game assignment covers all of its streams and streamless builds. Assignments can expire.

Server roles are separate:

Admins also have maintainer access to every game. Metrics readers have no game access unless they receive a content role too. admin is what the admin panel requires: content roles alone do not open it, and everyone without it works through the desktop app or the CLI.

The desktop app hides what your roles do not reach: a tester sees no Commit screen, and only a maintainer gets the create/delete game, create/delete stream, and edit-description controls. The stream picker on the Commit screen lists only streams you may actually commit into, allowlist included. The server enforces all of this regardless of what any client renders.

A fresh or upgraded server assigns developer on all games to the built-in everyone principal. This keeps the default collaborative: anyone signed in can browse, fetch, report, and commit. Assign narrower roles and revoke the everyone row from the Access page to lock a server down.

Manage assignments from the server host:

sudo -u vsync vsync-server role assign alex maintainer --game ember
sudo -u vsync vsync-server role assign partner tester --game ember --stream release --expires 90d
sudo -u vsync vsync-server role list --game ember
sudo -u vsync vsync-server role revoke 42

The revoke command takes the assignment ID printed by role list.

Stream commit allowlists

New streams allow *, meaning any principal with developer-or-higher access at that scope may commit. Protect a stream by replacing * with one or more principal names:

sudo -u vsync vsync-server committer set ember release ci-release,alex
sudo -u vsync vsync-server committer list ember release

The allowlist only restricts commits. It does not grant a role: an allowlisted tester still cannot commit, and an unlisted maintainer or admin cannot commit to a protected stream.

Manage people

Use Users in the admin panel to invite, reset, disable, or re-enable people, and to set the email address they can use when signing in. Password sessions expire after 30 days. Disabling a person revokes all of their credentials and blocks another login.

Bootstrap the first admin on the server host:

sudo -u vsync vsync-server user add ali --admin

Prefix the printed invite path with the server URL, open it, choose a password, and sign in to /admin.

Set or update an email without resetting the password (admin UI save email, or on the host):

sudo -u vsync vsync-server user set-email ali ali@example.com

Addresses are stored and matched lowercase, so signing in is not case sensitive. Two accounts cannot share an address: upgrading a server where two did keeps it on the older account and clears the other, which you can set again with user set-email.

Service tokens

Raw tokens create or target explicit service identities. They never mint a credential for an existing person:

sudo -u vsync vsync-server token create ci-uploader --expires 90d
sudo -u vsync vsync-server role assign ci-uploader developer --game my-game

The expiry is optional. The token is shown once and only its hash is stored. Keep it in the CI secret store and expose it only to trusted jobs:

VSYNC_SERVER=https://builds.example.com
VSYNC_TOKEN=vs_...
VSYNC_GAME=my-game
VSYNC_PLATFORM=win64

List or revoke service credentials from the host:

sudo -u vsync vsync-server token list
sudo -u vsync vsync-server token revoke ci-uploader