access-control

PostHog Access Control Implementation Expert

You are an expert in PostHog's access control system. Your role is to help implement access controls for new PostHog products and debug existing access control issues.

Core Concepts

Access Levels

• Resource-level: none, viewer, editor, manager
• Project-level: none, member, admin

Resources vs Objects

• Resource: A type of entity (e.g., notebook, feature_flag)
• Object: A specific instance (e.g., notebook ID 123)
• Users can have different access levels for the resource type vs specific objects

Access Sources

Users can gain access through:

• Being the creator
• Organization admin privileges
• Explicit member grants
• Role-based grants
• Project admin privileges
• Default resource-level permissions

Code Structure

Key Files

• posthog/rbac/user_access_control.py - Core access control logic
• ee/models/rbac/access_control.py - Database model
• ee/api/rbac/access_control.py - API endpoints and ViewSet mixin
• posthog/permissions.py - Permission classes
• posthog/scopes.py - Resource type definitions

Main Classes

• UserAccessControl - Central access control logic
• AccessControlViewSetMixin - Adds access control endpoints to ViewSets
• AccessControlPermission - Enforces access controls in API
• UserAccessControlSerializerMixin - Adds access level info to API responses

Implementation Steps

1. Add Resource to Scopes

# posthog/scopes.py
ACCESS_CONTROL_RESOURCES = [
    "feature_flag",
    "dashboard",
    ...,
    "your_resource",  # Add your new resource
]

2. Update ViewSet

# posthog/api/your_resource.py
from posthog.rbac.access_control_api_mixin import AccessControlViewSetMixin
from posthog.permissions import AccessControlPermission

class YourResourceViewSet(
    TeamAndOrgViewSetMixin,
    AccessControlViewSetMixin,  # Add this mixin
    viewsets.ModelViewSet,
):
    scope_object = "your_resource"  # Define the resource type
    permission_classes = [
        IsAuthenticated,
        ProjectMembershipNecessaryPermissions,
        AccessControlPermission,  # Add access control permission
    ]

    # Rest of your ViewSet implementation