Permissions, restrictions and public links
Orbit Folio does not have a separate user list. A space belongs to an Orbit project, and the roles people hold in that project decide what they can do. This page is for space and project administrators, and for anyone who wants to share a page.
Access follows the project
Section titled “Access follows the project”Project roles are administrator, member and viewer. Folio checks the role on every request, so a change in the project takes effect at once. A person who is deactivated loses access immediately.
Who may open Knowledge at all is chosen per person by a site administrator. See People, groups, guests and product access.
| Action | Who |
|---|---|
| Read a page | Anyone with a project role, unless a view restriction hides the page |
| Comment and react | Anyone who can see the page, in a space that is not archived, viewers included |
| Edit a page, upload and delete its files | Anyone who can edit the page |
| Create a space template | Anyone who can write in the space |
| Mark a page as verified | The page owner or a project administrator |
| Archive a space, delete from the trash for good | Administrators of the space |
Restrict a page
Section titled “Restrict a page”A page can have a view restriction or an edit restriction. Each page has an Access window, and a restricted page shows a restriction icon.
Folio applies one rule of inheritance:
- A restriction applies to the whole subtree below the page, the same way for viewing and for editing.
- When several ancestors are restricted, a person must be included in all of them.
- Project administrators are not limited by restrictions, and space administrators can always lift them. No restriction is left without someone who can remove it.
A page that a person may not view disappears for them everywhere:
- the page tree, search and quick open (Ctrl+K);
- recent pages and backlinks;
- the Related pages block of a work item;
- the trash and the activity log;
- the page’s files.
A [[Page]] link to a hidden page arrives without its title and id. Notifications that were sent before the restriction also disappear from that person’s inbox.
Check why someone has access
Section titled “Check why someone has access”Folio can show, for a person and a page, the effective right and the rule that gave it. Use it when someone asks why they can see a page, or why they cannot edit one.
For project-level access, the permission helper shows each permission allowed or refused with the reason. See People, groups, guests and product access.
Changes to permissions are written to the page’s activity log. See Versions, drafts and conflicts.
Share a page with a public link
Section titled “Share a page with a public link”A public link lets people without an account read one page. It is read-only.
| Property | Value |
|---|---|
| Lifetime | 1 to 90 days |
| Revocation | A revoked link stops working at once |
| Address | A link of the form /folio/s/<token> |
| Storage | Folio keeps only a hash of the token |
| Search engines | The page is marked noindex and served with a strict content security policy |
A page with a view restriction cannot be published. If a page gets a restriction after a link was issued, the existing links stop working.
What a public page shows
Section titled “What a public page shows”A public page is rendered by the server from the same Markdown. Everything is escaped, and some live content is replaced.
| In the page | In the public link |
|---|---|
| Work item keys | Plain text |
| Embedded work lists | Hidden |
forge-file blocks |
A short sentence, without the file path |
pulse-chart blocks |
A short sentence, without the service name |
properties block |
A table |
properties-report block |
A sentence, without data |
| Images and files of this page | Shown, only while the link is alive |
| Files of other pages | Plain text |