Overview

SveltyCMS 2.0 features a completely overhauled Access Management system built with Svelte 5 runes. This system provides granular control over who can access what, across all tenants.

Core Pillars of Access Management

1. Users: Individual accounts with authentication credentials and assigned roles.
2. Roles: Named collections of permissions (e.g., Editor, Developer, Admin).
3. Permissions: Fine-grained capability toggles (e.g., content.write, media.delete).
4. Website Tokens: API-first access tokens for frontend applications and external integrations.

---

🛡️ User Management

The User Management dashboard (/user) leverages Svelte 5’s fine-grained reactivity to handle thousands of users with zero lag.

• Real-time Filtering: Instant search across email, username, and role.
• Bulk Actions: Block, unblock, or delete multiple users in a single operation.
• Session Control: View active sessions per user and force-logout if necessary.
• Tenant Isolation: Assign users to specific tenants or grant cross-tenant access.

User States

State	Icon	Behavior
Active	✗	Full access based on permissions.
Blocked	✓	Authentication denied immediately.
Pending	⏳	Invitation token sent, but not yet consumed.

---

🔑 Invitation System (Email Tokens)

Administrators do not create passwords for users. Instead, they send secure Email Tokens.

1. Generate: Admin selects an email, role, and expiry (1h to 90d).
2. Send: System sends a secure registration link.
3. Consume: User sets their own password and (optionally) 2FA.
4. Audit: Every token creation and consumption is logged in the crypto-chained audit trail.

---

🎭 Roles & Permissions (RBAC)

Roles are managed in Config > Access Management.

• Hierarchical Roles: Roles can inherit permissions from other roles.
• Custom Permissions: Developers can define custom permission strings in their collection schemas.
• Admin Role: The admin role is special and bypasses all permission checks (Superuser).

---

🌐 Website Tokens (API Access)

For headless deployments, administrators can generate Website Tokens.

• Scoped Access: Tokens can be restricted to specific collections and actions (Read-Only vs. Read/Write).
• TTL Control: Set specific expiration dates or create permanent tokens.
• Security: website tokens are stored as non-reversible hashes in the database.

---

Technical Performance (Svelte 5)

Metric	Access Management	Status
User Search	< 10ms	Blazing Fast
Role Toggle	Partial Update	UX Precision
Memory usage	Low (Signal-based)	Highly Efficient

---

Related Documentation

• Authentication Architecture
• API Access Tokens
• Audit Log System
• Behavioral Learning Engine — Learns from user access patterns to optimize cache and navigation