Permissions
Role Based Permissions System
EAS uses a role based permission system. The system is made up of Permissions, Internal Roles, and External Roles. Internal Roles can be assigned a number of permissions to grant them the ability to perform actions against various resources. An External Role cannot be assigned permissions directly but can be assigned a number of Internal Roles which it will inherit permissions from. A request can provide a number of External Roles by name via its access token. A Request can only provide External Roles, it cannot provide Internal Roles or Permissions directly.
Default Roles
When the EAS database is initialised. The following Roles are created.
Default Internal Roles
| Internal Role | Permissions |
|---|---|
MAP_VIEWER_INTERNAL | EWB:READ, OPPORTUNITIES:READ, LOCATION_SERVICE:READ |
STUDIES_CREATOR_INTERNAL | STUDIES:READ, STUDIES:CREATE, STUDIES:DELETE |
RUN_HOSTING_CAPACITY_INTERNAL | HC_WORK_PACKAGE:READ, HC_WORK_PACKAGE:CREATE, HC_WORK_PACKAGE:CANCEL, HC_WORK_PACKAGE:DIFF |
EWB_ADMIN_INTERNAL | EWB:SWITCH, EWB:LOCK, EWB:UNLOCK |
MODEL_EXPORTER_INTERNAL | POWER_FACTORY_MODEL_EXPORT:READ, POWER_FACTORY_MODEL_EXPORT:CREATE, POWER_FACTORY_MODEL_EXPORT:DELETE, POWER_FACTORY_MODEL_EXPORT:UPDATE, POWER_FACTORY_EXPORT_TEMPLATE:READ, POWER_FACTORY_EXPORT_TEMPLATE:CREATE, POWER_FACTORY_EXPORT_TEMPLATE:DELETE, POWER_FACTORY_EXPORT_TEMPLATE:UPDATE, SINCAL_MODEL_EXPORT:READ, SINCAL_MODEL_EXPORT:CREATE, SINCAL_MODEL_EXPORT:DELETE, SINCAL_MODEL_EXPORT:UPDATE, SINCAL_EXPORT_TEMPLATE:READ, SINCAL_EXPORT_TEMPLATE:CREATE, SINCAL_EXPORT_TEMPLATE:DELETE, SINCAL_EXPORT_TEMPLATE:UPDATE |
METRICS_VIEWER_INTERNAL | METRICS:READ |
ALLOW_ALL_INTERNAL | POWER_FACTORY_EXPORT_TEMPLATE:READ, POWER_FACTORY_EXPORT_TEMPLATE:CREATE, POWER_FACTORY_EXPORT_TEMPLATE:UPDATE, POWER_FACTORY_EXPORT_TEMPLATE:DELETE, POWER_FACTORY_MODEL_EXPORT:CREATE, POWER_FACTORY_MODEL_EXPORT:READ, POWER_FACTORY_MODEL_EXPORT:UPDATE, POWER_FACTORY_MODEL_EXPORT:DELETE, SINCAL_MODEL_EXPORT:READ, SINCAL_MODEL_EXPORT:CREATE, SINCAL_MODEL_EXPORT:DELETE, SINCAL_MODEL_EXPORT:UPDATE, SINCAL_EXPORT_TEMPLATE:READ, SINCAL_EXPORT_TEMPLATE:CREATE, SINCAL_EXPORT_TEMPLATE:DELETE, SINCAL_EXPORT_TEMPLATE:UPDATE, STUDIES:READ, STUDIES:DELETE, STUDIES:CREATE, EWB:SWITCH, EWB:LOCK, EWB:UNLOCK, HC_WORK_PACKAGE:CREATE, HC_WORK_PACKAGE:READ, HC_WORK_PACKAGE:CANCEL, EWB:READ, METRICS:READ, SINCAL_EXPORTER_LOGS:READ, OPPORTUNITIES:READ, LOCATION_SERVICE:READ, INGESTOR:RUN, MACHINE_TOKEN:CREATE, HC_WORK_PACKAGE:UPDATE |
NETWORK_MODEL_EXECUTOR_INTERNAL | INGESTOR:RUN |
MACHINE_TOKEN_CREATOR_INTERNAL | MACHINE_TOKEN:CREATE |
Default External Roles
| External Role | Internal Roles | Overview |
|---|---|---|
SUPER_ADMIN | ALLOW_ALL_INTERNAL | Provides complete access to all EAS functionality. |
EWB_ADMIN | EWB_ADMIN_INTERNAL | The ability to change the network model currently loaded in EWB. |
TIMESERIES_MODELLER | RUN_HOSTING_CAPACITY_INTERNAL | The ability to start and stop Hosting Capacity work packages. |
MODELLER | MODEL_EXPORTER_INTERNAL | The ability to export Power Factory and Sincal models. |
DEVELOPER | STUDIES_CREATOR_INTERNAL | The ability to create studies. |
MAP_VIEWER | MAP_VIEWER_INTERNAL | The ability to retrieve any map data from EWB. The ability to retrieve "opportunity" data |
METRICS_VIEWER | METRICS_VIEWER_INTERNAL | The ability to retrieve any information from the Metrics Database. |
NETWORK_MODEL_EXECUTOR | NETWORK_MODEL_EXECUTOR_INTERNAL | The ability to trigger ingestion of a new CIM network model into the Energy Workbench. |
INTEGRATION_ADMIN | MACHINE_TOKEN_CREATOR_INTERNAL | The ability to create machine-to-machine tokens. |
Http REST Endpoints
| Permission | Required for | Provided by default role |
|---|---|---|
EWB:READ | api/network/graphql, api/network/hierarchy, api/network/feeder-assets/{container}/{containerId}, api/network/assets/{assetId}, api/network/find/{search}, api/network/assets/by-location/{locationId}, api/network/trace/upstream/asset/{assetId}, api/network/assets/graphics/geo-json, api/energy/profiles/max-demand/{id}, api/energy/profiles/max-demand, api/energy/profiles/max-demand/combine , api/energy/profiles/min-demand/{id} , api/energy/profiles/profiles/range/{id}/from-date/{fromDate}/to-date/{toDate} , api/energy/profiles/weather/{id}/season/{season}/day/{day}/temperature/{temperature}/variance/{variance}, api/energy/analysis/summary, api/energy/analysis/ev/{chargingBlockKw}, api/map/tile/{z}/{x}/{y} | SUPER_ADMIN, MAP_VIEWER |
POWER_FACTORY_MODEL_EXPORT:READ | api/power-factory-model/{id} | SUPER_ADMIN, MODELLER |
SINCAL_MODEL_EXPORT:READ | api/sincal-model/{id} | SUPER_ADMIN, MODELLER |
SINCAL_EXPORTER_LOGS:READ | api/sincal-model/{id}/logs | SUPER_ADMIN |
GraphQL Queries
The GraphQL API is served at /api/graphql. All GraphQL queries forwarded to the EWB server via api/network/graphql require EWB:READ permissions.
| Permission | Required for | Provided by default role |
|---|---|---|
EWB:READ | All GraphQL queries forwarded to the EWB server via api/network/graphql | SUPER_ADMIN, MAP_VIEWER |
EWB:LOCK | lockNetworkModelDatabase | SUPER_ADMIN, EWB_ADMIN |
EWB:SWITCH | switchNetworkModelDatabase | SUPER_ADMIN, EWB_ADMIN |
EWB:UNLOCK | unlockNetworkModelDatabase | SUPER_ADMIN, EWB_ADMIN |
HC_WORK_PACKAGE:CANCEL | cancelWorkPackage | SUPER_ADMIN, TIMESERIES_MODELLER |
HC_WORK_PACKAGE:CREATE | runWorkPackage | SUPER_ADMIN, TIMESERIES_MODELLER |
HC_WORK_PACKAGE:DIFF | generateNetworkPerformanceDiff, generateEnhancedNetworkPerformanceDiff | SUPER_ADMIN, TIMESERIES_MODELLER |
HC_WORK_PACKAGE:READ | getWorkPackageById, getWorkPackageProgress, getWorkPackages, getWorkPackageTree | SUPER_ADMIN, TIMESERIES_MODELLER |
HC_WORK_PACKAGE:UPDATE | editWorkPackage | SUPER_ADMIN |
INGESTOR:RUN | executeIngestor | SUPER_ADMIN |
LOCATION_SERVICE:READ | getOpportunities(identifiedObject location information), getOpportunityLocations(identifiedObject location information), getOpportunitiesForEquipment(identifiedObject location information), getOpportunity(identifiedObject location information), getDurationCurves(identifiedObject location information) | SUPER_ADMIN, MAP_VIEWER |
MACHINE_TOKEN:CREATE | createMachineApiKey | SUPER_ADMIN, INTEGRATION_ADMIN |
METRICS:READ | getAllJobs, getNewestJob, getSources, getMetrics | SUPER_ADMIN, METRICS_VIEWER |
OPPORTUNITIES:READ | getOpportunities, getOpportunityLocations, getOpportunitiesForEquipment, getOpportunity, getDurationCurves | SUPER_ADMIN, MAP_VIEWER |
POWER_FACTORY_MODEL_EXPORT:CREATE | createPowerFactoryModel | SUPER_ADMIN, MODELLER |
POWER_FACTORY_MODEL_EXPORT:DELETE | deletePowerFactoryModel | SUPER_ADMIN, MODELLER |
POWER_FACTORY_MODEL_EXPORT:READ | powerFactoryModelById, powerFactoryModelsByIds, pagedPowerFactoryModels | SUPER_ADMIN, MODELLER |
POWER_FACTORY_EXPORT_TEMPLATE:CREATE | createPowerFactoryModelTemplate | SUPER_ADMIN, MODELLER |
POWER_FACTORY_EXPORT_TEMPLATE:DELETE | deletePowerFactoryModelTemplate | SUPER_ADMIN, MODELLER |
POWER_FACTORY_EXPORT_TEMPLATE:READ | powerFactoryModelTemplateById, powerFactoryModelTemplatesByIds, pagedPowerFactoryModelTemplates | SUPER_ADMIN, MODELLER |
POWER_FACTORY_EXPORT_TEMPLATE:UPDATE | updatePowerFactoryModelTemplate | SUPER_ADMIN, MODELLER |
SINCAL_MODEL_EXPORT:CREATE | createSincalModel | SUPER_ADMIN, MODELLER |
SINCAL_MODEL_EXPORT:DELETE | deleteSincalModel | SUPER_ADMIN, MODELLER |
SINCAL_MODEL_EXPORT:READ | sincalModelById, sincalModelsByIds, pagedSincalModels | SUPER_ADMIN, MODELLER |
SINCAL_EXPORT_PRESET:CREATE | createSincalModelPreset | SUPER_ADMIN, MODELLER |
SINCAL_EXPORT_PRESET:DELETE | deleteSincalModelPreset | SUPER_ADMIN, MODELLER |
SINCAL_EXPORT_PRESET:READ | sincalModelPresetById, sincalModelPresetsByIds, pagedSincalModelPresets | SUPER_ADMIN, MODELLER |
SINCAL_EXPORT_PRESET:UPDATE | updateSincalModelPreset | SUPER_ADMIN, MODELLER |
STUDIES:CREATE | addStudies | SUPER_ADMIN, DEVELOPER |
STUDIES:DELETE | deleteStudies | SUPER_ADMIN, DEVELOPER |
STUDIES:READ | studiesById, studies, pagedStudies, resultsById, stylesById | SUPER_ADMIN, DEVELOPER |