nocobase-app-plugin-users

Register Authentication, Authorization, and Users in the Client and Server plugin arrays, then configure the client factory with a mount and path. For example, users({ mount: 'settings', path: '/users' }) produces /settings/users, and you must grant page:users/access to roles that may open it.

Resolve userRoleScopeRegistryToken in your application or business plugin ServiceProvider and register one UserRoleScope during boot(). The scope owns its options, assignment lookup, filtering, atomic replacement, and disable guards, and should be unregistered during shutdown().

Every HTTP route requires Authentication and Authorization, checking a user resource with actions like read, create, update, disable, enable, assign-role, reset-password, or revoke-sessions. Account creation checks both create and assign-role, and anonymous requests return 401 while missing actions return 403.

No. Authentication owns user identity, credentials, account state, password hashing, and Sessions. The Users plugin only owns the management API, built-in page, orchestration transaction, user authorization handler, and role-scope registry, and scopes must not write Authentication's internal tables.

The plugin does not provide user deletion or invitations, and it creates no roles or grants by itself. Conditional grants are not accepted as unrestricted user-management grants, and disabling a user invalidates their HTTP Sessions and Realtime connections.