Permissions
Role Based Permissions System
EAS uses a role based permission system. The system is made up of Permissions, Internal Roles, and External Roles. Internal Roles can be assigned a number of permissions to grant them the ability to perform actions against various resources. An External Role cannot be assigned permissions directly but can be assigned a number of Internal Roles which it will inherit permissions from. A request can provide a number of External Roles by name via its access token. A Request can only provide External Roles, it cannot provide Internal Roles or Permissions directly.
Default Roles
When the EAS database is initialised. The following Roles are created.
Default Internal Roles
| Internal Role | Permissions |
|---|---|
MAP_VIEWER_INTERNAL | EWB:READ, OPPORTUNITIES:READ, LOCATION_SERVICE:READ |
EWB_UPDATER_INTERNAL | EWB:UPDATE |
STUDIES_CREATOR_INTERNAL | STUDIES:READ, STUDIES:CREATE, STUDIES:DELETE |
RUN_HOSTING_CAPACITY_INTERNAL | HC_WORK_PACKAGE:READ, HC_WORK_PACKAGE:CREATE, HC_WORK_PACKAGE:CANCEL, HC_WORK_PACKAGE:DIFF |
EWB_ADMIN_INTERNAL | EWB:SWITCH, EWB:LOCK, EWB:UNLOCK |
MODEL_EXPORTER_INTERNAL | HC_INPUT:READ,POWER_FACTORY_MODEL_EXPORT:READ, POWER_FACTORY_MODEL_EXPORT:CREATE, POWER_FACTORY_MODEL_EXPORT:DELETE, POWER_FACTORY_MODEL_EXPORT:UPDATE, POWER_FACTORY_EXPORT_TEMPLATE:READ, POWER_FACTORY_EXPORT_TEMPLATE:CREATE, POWER_FACTORY_EXPORT_TEMPLATE:DELETE, POWER_FACTORY_EXPORT_TEMPLATE:UPDATE, SINCAL_MODEL_EXPORT:READ, SINCAL_MODEL_EXPORT:CREATE, SINCAL_MODEL_EXPORT:DELETE, SINCAL_MODEL_EXPORT:UPDATE, SINCAL_EXPORT_TEMPLATE:READ, SINCAL_EXPORT_TEMPLATE:CREATE, SINCAL_EXPORT_TEMPLATE:DELETE, SINCAL_EXPORT_TEMPLATE:UPDATE |
METRICS_VIEWER_INTERNAL | METRICS:READ |
ALLOW_ALL_INTERNAL | POWER_FACTORY_EXPORT_TEMPLATE:READ, POWER_FACTORY_EXPORT_TEMPLATE:CREATE, POWER_FACTORY_EXPORT_TEMPLATE:UPDATE, POWER_FACTORY_EXPORT_TEMPLATE:DELETE, POWER_FACTORY_MODEL_EXPORT:CREATE, POWER_FACTORY_MODEL_EXPORT:READ, POWER_FACTORY_MODEL_EXPORT:UPDATE, POWER_FACTORY_MODEL_EXPORT:DELETE, SINCAL_MODEL_EXPORT:READ, SINCAL_MODEL_EXPORT:CREATE, SINCAL_MODEL_EXPORT:DELETE, SINCAL_MODEL_EXPORT:UPDATE, SINCAL_EXPORT_TEMPLATE:READ, SINCAL_EXPORT_TEMPLATE:CREATE, SINCAL_EXPORT_TEMPLATE:DELETE, SINCAL_EXPORT_TEMPLATE:UPDATE, STUDIES:READ, STUDIES:DELETE, STUDIES:CREATE, EWB:SWITCH, EWB:LOCK, EWB:UNLOCK, HC_WORK_PACKAGE:CREATE, HC_WORK_PACKAGE:READ, HC_WORK_PACKAGE:CANCEL, EWB:READ, METRICS:READ, SINCAL_EXPORTER_LOGS:READ, OPPORTUNITIES:READ, LOCATION_SERVICE:READ, INGESTOR:RUN, MACHINE_TOKEN:CREATE, HC_WORK_PACKAGE:UPDATE, SINCAL_GLOBAL_CONFIG:READ, SINCAL_GLOBAL_CONFIG:UPDATE |
NETWORK_MODEL_EXECUTOR_INTERNAL | INGESTOR:RUN |
MACHINE_TOKEN_CREATOR_INTERNAL | MACHINE_TOKEN:CREATE, MACHINE_TOKEN:READ |
EWB_CUSTOMER_VIEWER_INTERNAL | EWB_CUSTOMER:READ |
EWB_DIAGRAM_VIEWER_INTERNAL | EWB_DIAGRAM:READ |
Default External Roles
| External Role | Internal Roles | Overview |
|---|---|---|
SUPER_ADMIN | ALLOW_ALL_INTERNAL | Provides complete access to all EAS functionality. |
EWB_ADMIN | EWB_ADMIN_INTERNAL | The ability to change the network model currently loaded in EWB. |
TIMESERIES_MODELLER | RUN_HOSTING_CAPACITY_INTERNAL | The ability to start and stop Hosting Capacity work packages. |
MODELLER | MODEL_EXPORTER_INTERNAL | The ability to export Power Factory and Sincal models. |
DEVELOPER | STUDIES_CREATOR_INTERNAL | The ability to create studies. |
MAP_VIEWER | MAP_VIEWER_INTERNAL | The ability to retrieve any map data from EWB. The ability to retrieve "opportunity" data |
EWB_UPDATER | EWB_UPDATER_INTERNAL | The ability to update EWB data. |
METRICS_VIEWER | METRICS_VIEWER_INTERNAL | The ability to retrieve any information from the Metrics Database. |
NETWORK_MODEL_EXECUTOR | NETWORK_MODEL_EXECUTOR_INTERNAL | The ability to trigger ingestion of a new CIM network model into the Energy Workbench. |
INTEGRATION_ADMIN | MACHINE_TOKEN_CREATOR_INTERNAL | The ability to create and view machine-to-machine tokens. |
EWB_CUSTOMER_VIEWER | EWB_CUSTOMER_VIEWER_INTERNAL | The ability to retrieve data from EWB's customer service. |
EWB_DIAGRAM_VIEWER | EWB_DIAGRAM_VIEWER_INTERNAL | The ability to retrieve data from EWB's diagram service. |
Http REST Endpoints
| Permission | Required for | Provided by default role |
|---|---|---|
EWB:READ | api/network/graphql, api/network/hierarchy, api/network/feeder-assets/{container}/{containerId}, api/network/assets/{assetId}, api/network/find/{search}, api/network/assets/by-location/{locationId}, api/network/trace/upstream/asset/{assetId}, api/network/assets/graphics/geo-json, api/energy/profiles/max-demand/{id}, api/energy/profiles/max-demand, api/energy/profiles/max-demand/combine , api/energy/profiles/min-demand/{id} , api/energy/profiles/profiles/range/{id}/from-date/{fromDate}/to-date/{toDate} , api/energy/profiles/weather/{id}/season/{season}/day/{day}/temperature/{temperature}/variance/{variance}, api/energy/analysis/summary, api/energy/analysis/ev/{chargingBlockKw}, api/map/tile/{z}/{x}/{y} | SUPER_ADMIN, MAP_VIEWER |
POWER_FACTORY_MODEL_EXPORT:READ | api/power-factory-model/{id} | SUPER_ADMIN, MODELLER |
SINCAL_MODEL_EXPORT:READ | api/sincal-model/{id} | SUPER_ADMIN, MODELLER |
SINCAL_EXPORTER_LOGS:READ | api/sincal-model/{id}/logs | SUPER_ADMIN |
GraphQL Queries
The GraphQL API is served at /api/graphql. All GraphQL queries forwarded to the EWB server via api/network/graphql require EWB:READ permissions.
| Permission | Required for | Provided by default role |
|---|---|---|
EWB:READ | All GraphQL queries forwarded to the EWB server via api/network/graphql | SUPER_ADMIN, MAP_VIEWER |
EWB:LOCK | lockNetworkModelDatabase | SUPER_ADMIN, EWB_ADMIN |
EWB:SWITCH | switchNetworkModelDatabase, getNetworkModels | SUPER_ADMIN, EWB_ADMIN |
EWB:UNLOCK | unlockNetworkModelDatabase | SUPER_ADMIN, EWB_ADMIN |
EWB_CUSTOMER:READ | Accessing the customer service via the EWB SDK. | SUPER_ADMIN, EWB_CUSTOMER_VIEWER |
EWB_DIAGRAM:READ | Accessing the diagram service via the EWB SDK. | SUPER_ADMIN, EWB_DIAGRAM_VIEWER |
HC_INPUT:READ | getScenarioConfigurations | SUPER_ADMIN, MODELLER |
HC_WORK_PACKAGE:CANCEL | cancelWorkPackage | SUPER_ADMIN, TIMESERIES_MODELLER |
HC_WORK_PACKAGE:CREATE | runWorkPackage | SUPER_ADMIN, TIMESERIES_MODELLER |
HC_WORK_PACKAGE:DIFF | generateNetworkPerformanceDiff, generateEnhancedNetworkPerformanceDiff | SUPER_ADMIN, TIMESERIES_MODELLER |
HC_WORK_PACKAGE:READ | getWorkPackageById, getWorkPackageProgress, getWorkPackages, getWorkPackageTree | SUPER_ADMIN, TIMESERIES_MODELLER |
HC_WORK_PACKAGE:UPDATE | editWorkPackage | SUPER_ADMIN |
INGESTOR:RUN | executeIngestor | SUPER_ADMIN |
LOCATION_SERVICE:READ | getOpportunities(identifiedObject location information), getOpportunityLocations(identifiedObject location information), getOpportunitiesForEquipment(identifiedObject location information), getOpportunity(identifiedObject location information), getDurationCurves(identifiedObject location information) | SUPER_ADMIN, MAP_VIEWER |
MACHINE_TOKEN:CREATE | createMachineApiKey | SUPER_ADMIN, INTEGRATION_ADMIN |
MACHINE_TOKEN:READ | getMachineTokens | SUPER_ADMIN, INTEGRATION_ADMIN |
METRICS:READ | getAllJobs, getNewestJob, getSources, getMetrics | SUPER_ADMIN, METRICS_VIEWER |
OPPORTUNITIES:READ | getOpportunities, getOpportunityLocations, getOpportunitiesForEquipment, getOpportunity, getDurationCurves | SUPER_ADMIN, MAP_VIEWER |
POWER_FACTORY_MODEL_EXPORT:CREATE | createPowerFactoryModel | SUPER_ADMIN, MODELLER |
POWER_FACTORY_MODEL_EXPORT:DELETE | deletePowerFactoryModel | SUPER_ADMIN, MODELLER |
POWER_FACTORY_MODEL_EXPORT:READ | powerFactoryModelById, powerFactoryModelsByIds, pagedPowerFactoryModels | SUPER_ADMIN, MODELLER |
POWER_FACTORY_EXPORT_TEMPLATE:CREATE | createPowerFactoryModelTemplate | SUPER_ADMIN, MODELLER |
POWER_FACTORY_EXPORT_TEMPLATE:DELETE | deletePowerFactoryModelTemplate | SUPER_ADMIN, MODELLER |
POWER_FACTORY_EXPORT_TEMPLATE:READ | powerFactoryModelTemplateById, powerFactoryModelTemplatesByIds, pagedPowerFactoryModelTemplates | SUPER_ADMIN, MODELLER |
POWER_FACTORY_EXPORT_TEMPLATE:UPDATE | updatePowerFactoryModelTemplate | SUPER_ADMIN, MODELLER |
SINCAL_MODEL_EXPORT:CREATE | createSincalModel | SUPER_ADMIN, MODELLER |
SINCAL_MODEL_EXPORT:DELETE | deleteSincalModel | SUPER_ADMIN, MODELLER |
SINCAL_MODEL_EXPORT:READ | sincalModelById, sincalModelsByIds, pagedSincalModels | SUPER_ADMIN, MODELLER |
SINCAL_EXPORT_PRESET:CREATE | createSincalModelPreset | SUPER_ADMIN, MODELLER |
SINCAL_EXPORT_PRESET:DELETE | deleteSincalModelPreset | SUPER_ADMIN, MODELLER |
SINCAL_EXPORT_PRESET:READ | sincalModelPresetById, sincalModelPresetsByIds, pagedSincalModelPresets | SUPER_ADMIN, MODELLER |
SINCAL_EXPORT_PRESET:UPDATE | updateSincalModelPreset | SUPER_ADMIN, MODELLER |
SINCAL_GLOBAL_CONFIG:READ | sincalModelGlobalConfig | SUPER_ADMIN, MODELLER |
SINCAL_GLOBAL_CONFIG:UPDATE | sincalModelConfigUploadUrl, updateSincalModelConfigFilePath | SUPER_ADMIN, MODELLER |
STUDIES:CREATE | addStudies | SUPER_ADMIN, DEVELOPER |
STUDIES:DELETE | deleteStudies | SUPER_ADMIN, DEVELOPER |
STUDIES:READ | studiesById, studies, pagedStudies, resultsById, stylesById | SUPER_ADMIN, DEVELOPER |
EWB Permissions Mappings
To allow the use of EAS generated tokens with the EWB SDK, the following EAS permissions are mapped to the three roles defined by the EWB.
| EAS Permission | EWB Role | EWB access provided | Provided by default "External Role" |
|---|---|---|---|
EWB:READ | read:ewb | Access to connect to the network service with a gRPC NetworkConsumerClient. Also to all EWB HTTP REST endpoints (excluding /ewb/api/graphql/customers). | SUPER_ADMIN, MAP_VIEWER |
EWB:UPDATE | write:ewb | Access to connect to the network service with a gRPC UpdateNetworkStateClient. | SUPER_ADMIN, EWB_UPDATER |
EWB_CUSTOMER:READ | read:customer | Access to connect to the customer service with a gRPC CustomerConsumerClient. Also to the customer GraphQL endpoint /ewb/api/graphql/customers. | SUPER_ADMIN, EWB_CUSTOMER_VIEWER |
EWB_DIAGRAM:READ | read:diagram | Access to connect to the diagram service with a gRPC DiagramConsumerClient | SUPER_ADMIN, EWB_DIAGRAM_VIEWER |
The EWB Roles will be included in a generated token's "roles" claim when the External Roles being assigned to the new token inherit their matching EAS permission.
note
This permission check only happens at token creation time and cannot be updated or revoked after the token is created.