Manage who can build (RBAC)
Buildiq has two access boundaries, and they do different jobs.
Nextcloud's own app restriction decides who sees Buildiq in the top bar. Each app's own permissions decide what a person may do with that app. The second one is the load-bearing boundary. It is enforced on the server, on every request, and it is the one you set per app.
Every virtual app carries three roles: owner, editor and viewer. Each role is a list of Nextcloud groups or users.
Goal
By the end you will have given a group the editor role on one app, confirmed the change, and read the permission history.
Prerequisites
- You are an owner of the app you want to change, or you are in the Nextcloud admin group.
- The group you want to give access to exists under Settings → Users → Groups.
- At least one virtual app exists. If none does, start with Create a virtual app.
Steps
-
Open Apps in the Buildiq left navigation and click the card of the app you want to change.
-
In the app header, click Actions and pick Manage permissions. The entry only appears for owners.
-
The Permissions dialog opens with three group pickers: Owners (full control), Editors (can save drafts) and Viewers (read-only). Add your group to Editors.
-
Click Save permissions. The dialog refuses an empty owners list, so an app is never orphaned.
-
Ask someone in that group to reload Buildiq. They now see the app in Apps and can save drafts on it.
What each role may do
| Action | viewer | editor | owner |
|---|---|---|---|
| Read the manifest, browse the app | yes | yes | yes |
| Save a manifest draft | no | yes | yes |
| Publish, archive or re-open | no | no | yes |
| Change permissions, transfer ownership | no | no | yes |
| Delete the app | no | no | yes |
Hide Buildiq from everyone else
The roles above cover one app at a time. To keep Buildiq out of the top bar entirely, use Nextcloud's standard app restriction under Settings → Apps → Buildiq, or run:
occ app:enable buildiq --groups digital-team
This is coarse visibility only. It hides the entry, it does not protect the data.
Verification
The change is good when a member of the group sees the app in Apps and can save a draft. Someone with no role on the app gets a 403 from the manifest endpoint, with the body {"error":"forbidden","code":"buildiq.rbac.no_role"}.
Open Actions → Permission history to read who changed what, and when.
Common issues
| Symptom | Fix |
|---|---|
| Manage permissions is missing from the Actions menu | You are an editor or viewer, not an owner. Ask an owner to add you. |
| Manage permissions in the Groups & users widget does nothing | Known issue. Use the Actions menu in the app header instead. |
| A user still sees nothing after the group add | Nextcloud caches group membership per session. Ask them to log out and back in. |
| An admin sees an app nobody granted them | Members of the Nextcloud admin group can read any manifest. Every use is written to the permission history as an administrator bypass. |
Reference
- Curate the template catalogue: owners and editors may save an app as a template.
- Manage Buildiq settings: version, register and support contact.