# Permissions read should allow "inject" button

**URL:** <https://discourse.nodered.org/t/permissions-read-should-allow-inject-button/24490>\
**Category:** General\
**Created:** [9 April 2020 00:37 UTC](https://discourse.nodered.org/t/permissions-read-should-allow-inject-button/24490 "2020-04-09T00:37:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![aderici](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/aderici/32/37279_2.png) [@aderici](https://discourse.nodered.org/u/aderici)\
**Post date:** [9 April 2020 00:37 UTC](https://discourse.nodered.org/t/permissions-read-should-allow-inject-button/24490/1 "2020-04-09T00:37:59Z")

</div>

as far as i know currently we have \* and read permissions.

I would like to keep my flows read only on the remote server, but still allow admin users to be able to "inject" or "debug". is this even possible?

best regards,

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [9 April 2020 09:53 UTC](https://discourse.nodered.org/t/permissions-read-should-allow-inject-button/24490/2 "2020-04-09T09:53:39Z")

</div>

Do you mean you want them to be able to add inject and debug nodes without having write access to the flows file?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [9 April 2020 10:00 UTC](https://discourse.nodered.org/t/permissions-read-should-allow-inject-button/24490/3 "2020-04-09T10:00:02Z")

</div>

I assume its more the ability to click the inject button, rather than add new nodes to the configuration.

@aderici, a user can have multiple permissions. To give someone read-only access, but allow them to click the inject button, you can set their permissions to:

```auto
permissions: ["read","inject.write"]

```

---

<div class="post-metadata">

**Author:** ![aderici](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/aderici/32/37279_2.png) [@aderici](https://discourse.nodered.org/u/aderici)\
**Post date:** [9 April 2020 11:50 UTC](https://discourse.nodered.org/t/permissions-read-should-allow-inject-button/24490/4 "2020-04-09T11:50:10Z")

</div>

Thank you Nick, that piece of information really solved my problem.

Is there a long list of permissions i can chose from? Or does it work like "node-red-contrib-some-custom-node.write"

I'm thinking about debug, but i believe it is not an easy task. I have seen generic debuggers that add itself to the panel i will check them for debugging purposes,

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [9 April 2020 11:54 UTC](https://discourse.nodered.org/t/permissions-read-should-allow-inject-button/24490/5 "2020-04-09T11:54:25Z")

</div>

I don't have a list of the individual permissions - I had to double check the source code. I will see if I can pull out a list and put it somewhere useful.

The pattern will be `"XYZ.read"` and `"XYZ.write"` - its just a case of figuring out what values of XYZ are available 🙂

To use the Debug toggle button , you need `"debug.write"` permission. Just remember that it requires a deploy of the flows to save changes to the debug node state. So whilst they will be able to toggle its state, if Node-RED restarts, it will revert back to whatever it was original set to.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [23 April 2020 11:54 UTC](https://discourse.nodered.org/t/permissions-read-should-allow-inject-button/24490/6 "2020-04-23T11:54:28Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.