Read-only user - what is it?

Core Development
1

During our investigation of Node Red we have found a user with read-only access. There is a couple of questions:

  1. Is there any use case for this user? In the other words, is there any examples in what situations this user is needed?

  2. Can we modify read-only users in order to allow them to create flows in their isolated sandboxes, while admin user can see it?

2

Where are you seeing this user?

3

Hi @alex.mpplabs

This section of the docs describes how you can configure users and their permissions: Securing Node-RED : Node-RED

If you want to have a user who can view the flows but not make any changes. For example, I want to show you my flows, but not let you make any changes.

Nothing requires you to have a read-only user if you don't have a need for one.

If the user can make changes, they aren't a read-only user any more. As per the docs I linked to above, you can configure multiple users with read-write access in whatever way you want.

The Node-RED runtime is single-tenant. Whilst you may have multiple users able to access the editor, they are working on the same set of flows. There is no 'isolated sandbox' within Node-RED.

There are some 3rd-party platforms that make it easier to manage multiple users across multiple instances of Node-RED, with different levels of access control. For example FlowForge - (disclosure: when I'm not running the Node-RED project, I'm the CTO/Founder of FlowForge). It depends on what your specific requirements are.

4

Hi Nick!

Thanks for your answer.

We are actually planning to implement multitenancy in Node Red for the whole community in the beginning of 2023. If you'd like to join the effort, that would be great.

5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.