RBAC (multi-user)

FileDB supports two auth modes:

1. Single-password (default) — one password via -password, full access.
2. RBAC — multi-user, enabled by the presence of data/users.json.

The model applies uniformly across the HTTP API, Web UI, and the PostgreSQL/MySQL wire protocols — the same accounts, roles, and database access everywhere.

Creating users

./filedb -data ./data -add-user alice -add-user-password "secret" -add-user-role admin
./filedb -data ./data -add-user bob   -add-user-password "secret" -add-user-role read
./filedb -data ./data -add-user carol -add-user-password "secret" -add-user-role write -add-user-dbs shop,logs

Roles

• admin — full access to all databases, can manage users.
• write — SELECT/INSERT/UPDATE/DELETE on allowed databases, no DDL.
• read — SELECT/SHOW/EXPLAIN only, on allowed databases.

databases: ["*"] means access to every database; a list of names restricts to those.

Managing users via the API

# list (no password hashes)
curl $URL/api/rbac/users -H "X-Token: $TOKEN"

# create
curl -X POST $URL/api/rbac/users -H "X-Token: $TOKEN" -H "Content-Type: application/json" 
  -d '{"username":"frank","password":"x","role":"write","databases":["db1.fdb"]}'

# update role/password/databases
curl -X PUT $URL/api/rbac/users/frank -H "X-Token: $TOKEN" -d '{"role":"read"}'

# delete
curl -X DELETE $URL/api/rbac/users/frank -H "X-Token: $TOKEN"

A management UI is available at /rbac (admin only).

Safety rails

You can't delete your own account; you can't delete or demote the last admin; single-password is ignored once RBAC mode is active; repeated failed logins lock the account temporarily — enforced over HTTP and the wire protocols alike.