📄️ Authentication
Authentication is how Shesha confirms that a user is who they say they are before letting them into the application. Shesha's authentication framework is designed to provide a secure and flexible way to manage user authentication, supporting username/password login and passwordless one-time-pin (OTP) login out of the box, with an extension point for connecting your own external identity providers.
📄️ Access Control
Access control is a fundamental aspect of system security, ensuring that users can only access resources and perform actions they are authorized for. In the context of Shesha, access control is implemented through a combination of Role-Based Access Control (RBAC) and Scoped RBAC. These mechanisms allow administrators to define roles, assign permissions, and enforce security policies based on user roles and their associated scopes.
📄️ Security Classes and Interfaces
Shesha's authorization system is built from a handful of cooperating classes: one that manages roles, one that checks whether a user holds a permission, one that manages the "Protected Objects" a permission applies to, and one that ties the two together to authorize a request. This page covers each of them, verified against the actual shesha-core source rather than a general description.
📄️ Permission Based Security Model
Shesha adopts a permission-based model, which means users can only perform restricted actions if they've been granted that specific permission. Think of it like having different keys for different doors in a building - you can only enter the rooms you're authorised to access.
📄️ Endpoint Permissions
Every API endpoint in a Shesha application has a permission level that controls who can call it. By default, Shesha scans your application on startup and registers all endpoints in a central store called Permissioned Objects. From there, you can control access through code attributes, a system-wide default setting, or the Permissioned Objects configuration UI. Understanding how these three mechanisms interact - and which one takes priority - is essential for building secure APIs.
📄️ User Registration
Shesha lets users create their own accounts instead of requiring an administrator to create every account manually. You choose exactly how people sign up (by email, by mobile number, or not at all), what verification they must complete first, and whether they need to fill in extra information before their account is usable.