📄️ Authentication
Authentication is how Shesha confirms that a user is who they say they are before letting them into the application. Shesha's authentication framework is designed to provide a secure and flexible way to manage user authentication, supporting username/password login and passwordless one-time-pin (OTP) login out of the box, with an extension point for connecting your own external identity providers.
📄️ Access Control
Access control is a fundamental aspect of system security, ensuring that users can only access resources and perform actions they are authorized for. In the context of Shesha, access control is implemented through Role-Based Access Control (RBAC): administrators define roles, assign permissions to those roles, and assign roles to users to enforce security policies.
📄️ Security Classes and Interfaces
Shesha's authorization system is built from a handful of cooperating classes: one that manages roles, one that checks whether a user holds a permission, one that manages the "Protected Objects" a permission applies to, and one that ties the two together to authorize a request. This page covers each of them.
📄️ Permission Based Security Model
Shesha adopts a permission-based model, which means users can only perform restricted actions if they've been granted that specific permission. Think of it like having different keys for different doors in a building - you can only enter the rooms you're authorised to access.
📄️ Endpoint Permissions
Every API endpoint in a Shesha application has a permission level that controls who can call it. By default, Shesha scans your application on startup and registers all endpoints in a central store called Permissioned Objects. From there, you can control access through code attributes, a system-wide default setting, or the Permissioned Objects configuration UI. Understanding how these three mechanisms interact - and which one takes priority - is essential for building secure APIs.
📄️ User Registration
Shesha lets users create their own accounts instead of requiring an administrator to create every account manually. You choose exactly how people sign up (by email, by mobile number, or not at all), what verification they must complete first, and whether they need to fill in extra information before their account is usable.