Access Control

Overview

The permissions system has two layers:

1. Portal visibility — which brand portals a resource is visible on (replaces the old public/private toggle; managed via the "Portals" dialog)
2. Role-based capabilities — what operations each workspace role can perform (enforced via DAM_CAPABILITIES in plugins/helper.js)

Role Hierarchy

Four roles exist in the DAM. There is no member role.

Role	Who	DAM Access
brand-portal-user	External portal visitor	Brand portal only
viewer	Read-only workspace member	View, search, share/download, insights
manager	Content manager	Most operations except admin-only settings
admin	Workspace administrator	Full access

DAM Capabilities Matrix

Source: plugins/helper.js — DAM_CAPABILITIES object. Keys are snake_case.

Basic Access

Capability key	brand-portal-user	viewer	manager	admin
brand_portal_access	✓	✓	✓	✓
help_support	✓	✓	✓	✓

Content & Upload

Capability key	brand-portal-user	viewer	manager	admin
content_upload			✓	✓
uncategorized_assets_bar			✓	✓
uncategorized_assets_folder			✓	✓
duplicating_content			✓	✓
moving_content			✓	✓
deleting_content			✓	✓
sharing_downloading		✓	✓	✓

Folder Management

Capability key	brand-portal-user	viewer	manager	admin
creating_folders			✓	✓
editing_folder_name_description			✓	✓
folder_permission			✓	✓

Collage Management

Capability key	brand-portal-user	viewer	manager	admin
creating_collages			✓	✓
removing_collage			✓	✓
editing_collage_name_description			✓	✓
collage_permission			✓	✓
deleting_collage			✓	✓
removing_asset_from_collage			✓	✓

Asset Details

Capability key	brand-portal-user	viewer	manager	admin
editing_asset_name			✓	✓
editing_asset_description			✓	✓
asset_permission			✓	✓
viewing_insights		✓	✓	✓

Tags

Capability key	brand-portal-user	viewer	manager	admin
adding_tags			✓	✓
removing_tags			✓	✓
viewing_tags			✓	✓

Custom Fields

Capability key	brand-portal-user	viewer	manager	admin
managing_custom_fields			✓	✓
removing_custom_fields			✓	✓
managing_custom_fields_settings				✓
creating_new_custom_fields				✓

Asset Versioning

Capability key	brand-portal-user	viewer	manager	admin
viewing_versions		✓	✓	✓
downloading_versions		✓	✓	✓
adding_new_versions			✓	✓
restoring_versions			✓	✓
deleting_versions			✓	✓

Trash

Capability key	brand-portal-user	viewer	manager	admin
restoring_trash			✓	✓
managing_trash				✓

Search

Capability key	brand-portal-user	viewer	manager	admin
search_bar		✓	✓	✓
inner_search		✓	✓	✓

Account Settings

Capability key	brand-portal-user	viewer	manager	admin
account_settings				✓
account_admins				✓
adding_users				✓
manage_organization_notifications				✓
viewing_announcements				✓
guest_upload_manager				✓

Brand Portal

Capability key	brand-portal-user	viewer	manager	admin
creating_brand_portal			✓	✓
managing_brand_portal_users			✓	✓
managing_brand_portal_banners			✓	✓
managing_brand_portal_tiles			✓	✓
controlling_brand_portal_settings				✓

Share / Embed

Capability key	brand-portal-user	viewer	manager	admin
embedded_delete		✓	✓	✓
revoke_share		✓	✓	✓
advanced_settings		✓	✓	✓
manage_sharing			✓	✓

Note: For embedded_delete, revoke_share, and advanced_settings, viewers can only act on their own shares. Managers and admins can act on any.

Helper Functions

All helpers are registered on Vue.prototype via plugins/helper.js and accept a workspace object as their sole argument.

// Get workspace from store
const workspace = this.$store.state.auth.user.accessibleWorkspaces
  .find(w => w.id == this.$route.params.workspace_id)

// Usage in computed properties
computed: {
  canUpload() {
    return this.$canUploadContent(workspace)
  },
  canDelete() {
    return this.$canDeleteContent(workspace)
  }
}

Complete Helper Reference

Vue prototype method	Capability key checked
$canUploadContent(workspace)	content_upload
$canDeleteContent(workspace)	deleting_content
$canShareDownload(workspace)	sharing_downloading
$canMoveContent(workspace)	moving_content
$canDuplicateContent(workspace)	duplicating_content
$canCreateFolders(workspace)	creating_folders
$canEditFolderNameDescription(workspace)	editing_folder_name_description
$canManageFolderPermission(workspace)	folder_permission
$canCreateCollages(workspace)	creating_collages
$canRemoveCollage(workspace)	removing_collage
$canEditCollageNameDescription(workspace)	editing_collage_name_description
$canManageCollagePermission(workspace)	collage_permission
$canDeleteCollage(workspace)	deleting_collage
$canRemoveAssetFromCollage(workspace)	removing_asset_from_collage
$canEditAssetName(workspace)	editing_asset_name
$canEditAssetDescription(workspace)	editing_asset_description
$canManageAssetPermission(workspace)	asset_permission
$canViewInsights(workspace)	viewing_insights
$canAddTags(workspace)	adding_tags
$canRemoveTags(workspace)	removing_tags
$canViewTags(workspace)	viewing_tags
$canManageCustomFields(workspace)	managing_custom_fields
$canRemoveCustomFields(workspace)	removing_custom_fields
$canManageCustomFieldsSettings(workspace)	managing_custom_fields_settings
$canCreateNewCustomFields(workspace)	creating_new_custom_fields
$canAddNewVersions(workspace)	adding_new_versions
$canViewVersions(workspace)	viewing_versions
$canRestoreVersions(workspace)	restoring_versions
$canDeleteVersions(workspace)	deleting_versions
$canDownloadVersions(workspace)	downloading_versions
$canRestoreTrash(workspace)	restoring_trash
$canManageTrash(workspace)	managing_trash
$canUseSearchBar(workspace)	search_bar
$canUseInnerSearch(workspace)	inner_search
$canAccessAccountSettings(workspace)	account_settings
$canManageAccountAdmins(workspace)	account_admins
$canAddUsers(workspace)	adding_users
$canManageNotifications(workspace)	manage_organization_notifications
$canViewAnnouncements(workspace)	viewing_announcements
$canCreateBrandPortal(workspace)	creating_brand_portal
$canManageBrandPortalSettings(workspace)	controlling_brand_portal_settings
$canManageBrandPortalUsers(workspace)	managing_brand_portal_users
$canManageBrandPortalBanners(workspace)	managing_brand_portal_banners
$canManageBrandPortalTiles(workspace)	managing_brand_portal_tiles
$canViewUncategorizedAssetsBar(workspace)	uncategorized_assets_bar
$canViewUncategorizedAssetsFolder(workspace)	uncategorized_assets_folder
$canAccessHelpSupport(workspace)	help_support

Core Function

// plugins/helper.js
const canPerformDamOperation = (workspace, operation) => {
  if (!workspace || !operation) return false
  const allowedRoles = DAM_CAPABILITIES[operation]
  if (!allowedRoles) return false
  const user = getUserModulesAndRoles(workspace)
  if (!user || !user.hasDamAccess || !user.dam.role) return false
  return allowedRoles.includes(user.dam.role.toLowerCase())
}

The workspace object must come from accessibleWorkspaces (store) — it contains the user's role for that workspace. Never pass a plain workspace ID.

Resource Visibility Components

These manage which portals content is published to. There is no longer a binary public/private toggle.

components/dam/Dialogs/PermissionDialog.vue — "Portals" dialog

Completely redesigned. Title is "Portals". Shows a list of portals with per-portal toggle switches. Users select which portals a resource is visible on.

• Old behavior (main branch): public/private radio buttons
• New behavior (development branch): portal list, multiple-select toggles, instance_ids array in payload

Capability required: folder_permission / asset_permission / collage_permission

Key change: AssetPermissionDialog.vue was deleted — there is no separate asset confirmation dialog.

API payload:

POST /digital-assets/permission/change-permission
{
  workspace_id,
  visibility: 0,              // 0 = visible on selected portals
  instance_ids: [portalId1, portalId2],
  asset_ids: [...],           // plural arrays (bulk support)
  category_ids: [...],
  collection_ids: [...],
  nested_apply: 0 | 1,        // folders only
}

See Permission Dialog component for full props and usage.

components/dam/StaticPermissionDialog.vue

Shown when the user's plan does not permit portal visibility changes. Displays an upgrade CTA.

Middleware

Middleware file	What it checks
middleware/can-access-dam-module.js	User has brand_portal_access or higher for the workspace
middleware/can-access-dam-settings.js	User has account_settings capability (admin only)

Usage Pattern in Components

<template>
  <v-btn
    v-if="canCreate"
    :ripple="false"
    @click="openCreateDialog"
  >
    New Folder
  </v-btn>
</template>

<script>
export default {
  computed: {
    workspace() {
      return this.$store.state.auth.user?.accessibleWorkspaces
        ?.find(w => w.id == (this.$route.params.workspace_id || this.$getWorkspaceId()))
    },
    canCreate() {
      return this.$canCreateFolders(this.workspace)
    },
    canDelete() {
      return this.$canDeleteContent(this.workspace)
    },
    canShare() {
      return this.$canShareDownload(this.workspace)
    }
  }
}
</script>

Related Documentation

• Role-Based Access Matrix — role definitions and summary
• Folder Management — canCreateFolders, canUseInnerSearch usage
• Portals — portal-specific capabilities