App permissions and authentication

Setting permissions ensures that only the right people have access to your apps and pages. It's as if you're putting up a virtual fence, allowing you to control who can view or edit your work. This document explains how permissions interact between organizations, apps, pages, and custom roles in Rewst.

How permissions work for apps

Permissions flow downward: Organization → App

• Higher-level permissions always apply to everything beneath them.

• Lower-level permissions cannot remove access granted at a higher level.

• There is no per-page access control.

Roles and organizations work together

Custom roles must be created in the Settings menu for an organization, typically the parent org where the app resides. A user may only have access an app or page if they have both a role and that role assigned within an authorized organization.

The role creation dialog in the Settings menu - note the App section

In ... > Access, each organization grant has an Include subtenants option and an optional role filter. This is how child organizations get access.

Why app authentication matters

Authentication is a crucial aspect of securing your app and ensuring that only authorized users can access its content. When users attempt to view live pages within your app, whether they are a Rewst user or an outside individual, authentication is required. Rewst offers two app authentication options.

Ensure that your app's authentication system aligns with your users' expectations and complies with any relevant privacy and security standards. Regularly update and review your authentication processes to stay ahead of potential security challenges.

How authentication works

Rewst offers three access modes. To use them, navigate to ... › Access.

1. Restricted - Only chosen people and organizations

2. Generated link - Anyone with the generated link

3. Public - Anyone with the public app URL

Restricted access

An app viewer can either Sign in with Rewst or use Email verification

Option 1: Rewst login

This option requires all who access the app to be users of Rewst.

1. When a user tries to access live pages within your app, they will be redirected to the login page with fields to enter their Rewst login credentials.

2. Once authenticated, the system performs an authorization check to ensure the user has the necessary permissions to view the requested content.

3. If the authentication and authorization checks pass, the user is granted access to the live pages.

Option 2: Email verification

This option allows people to access the app if they are not users of Rewst.

1. Navigate to Apps to view your total app list in Rewst.

2. Click ... > Access.

3. Set the login for your app to Restricted.

4. Add the desired individual's email address to the access list. Add multiple email addresses if desired.

5. Click Save.

6. The individuals will be sent an email inviting them to look at your app with a link to access it. Note that the invite is sent only to addresses newly added from the most recent save— resaving does not resend to prior recipients who were already sent the invite.

7. When the individual clicks the link, they see an email verification screen. They enter their email address into the field, are sent a login code, then enter the code into the login screen.

8. If the authentication and authorization checks pass, the user is granted access to the live pages.

Generated link

1. Navigate to Apps to view your total app list in Rewst.

2. Click ... > Access.

3. Set the login for your app to Generated link.

4. Click Save.

Public

1. Navigate to Apps to view your total app list in Rewst.

2. Click ... > Access.

3. Set the login for your app to Public.

4. Click Save.