A DB role is a PostgreSQL role created on a specific host. It is mirrored in DBM and the host's catalog database.
| Type | Description |
|---|---|
BUILT_IN |
Internal system roles |
SERVICE |
Roles for standard services (JSON-RPC, ArcView, MQTT) |
PREDEFINED_SERVICE |
Roles for customer-predefined services |
CUSTOM_INTERNAL |
User-defined internal roles |
CUSTOM_EXTERNAL |
User-defined external roles |
HostRoleInstancePermissions)DB roles are granted granular permissions on each instance:
| Permission | Scope |
|---|---|
PROJECT_TABLES_READ |
Read project table structures |
PROJECT_ACCESS_READ |
Read project access info |
PROJECT_DATA_READ/WRITE/EDIT |
Data operations |
PROJECT_OBJECTS_READ/WRITE/EDIT |
Object operations |
INSTANCE_PROJECTS_SETTINGS_READ |
Read project settings |
INSTANCE_TEMPLATES_READ |
Read templates |
INSTANCE_ACCESS_READ |
Read users/devices/roles |
Standard services (JSON-RPC, ArcView, MQTT) have predefined permission sets.
DB roles use immediate permanent deletion (not two-phase) — the PostgreSQL role either exists or doesn't.
| Operation | Effect |
|---|---|
| Superadmin repair | Fix superadmin role |
| Role creation | Re-create missing roles |
| Permission sync | Resync instance permissions |
See Admin Permissions for required rights.