Bosca / Developers Developer Documentation

Identity & access

Identity and access, built in

Every request arrives as a principal, mapped to a profile, and permissions — granted to groups — decide who can see and change what, enforced by a shared evaluator on every read and write.

Principal & profile

Who's calling, and who they are

Authentication resolves a principal — the account behind the request, whether it signed in as a person or as an API token. The principal is just identity; the profile is who they are in your data, a separate record with its own id. Your code reads both from the request context, so a controller or a route always knows who it's acting for — and one principal can carry more than one profile.

  • A principal is the authenticated identity; a profile is the person's record.
  • Separate entities with separate ids, bridged through the context.
  • API tokens arrive as scoped principals, narrowed to what they may do.
request context
principalthe authenticated identity
profilethe person it represents

Permissions

Checked where the data lives

Each entity carries its own permissions — a grant of an action, like view, edit, or manage, to a group. On a read, the owning service filters the results to what you're allowed to see; on a write, it verifies your access before the change lands. Public items need no grant, and a child inherits its parent's access.

  • Per-entity permissions: an action granted on a specific record.
  • Reads are filtered to what you may see; writes are verified first.
  • Public items need no grant; children inherit their parent's access.
access
readfiltered to what you may see
writeverified before it takes effect

Groups

Granted to groups

Permissions are granted to groups. A principal gets access by belonging to a group that holds the grant, so access stays easy to reason about: put a principal in a group, and it inherits everything that group can do. Built-in roles come ready to use, and you add your own.

  • Permissions are granted to groups.
  • A principal inherits access from the groups it belongs to.
  • Built-in roles ship ready; add your own groups alongside them.
groups
administratorsfull access
editorscreate & edit content
viewersread-only

Keep exploring

More for developers

Developer Documentation

Local setup and the platform reference for APIs, services, identity, and runtime behavior.

Build on Bosca

The patterns Bosca is built from — and built with.

Architecture

Core and implementation modules in one Gradle build, with compile-time wiring.

Building a feature

From a model to a GraphQL and REST API.

Extending & automating

Jobs, events, caching, scripting, and the CLI.