You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
docs(auth): restructure auth docs into Fern navigation and fix rendering issues (#368)
Add the Access Control section to the Fern docs navigation (latest.yml),
covering authentication, authorization, deployment, and security model pages.
Fix permissions-reference table rendering by replacing escaped pipe characters
(`\\|`) with HTML entities (`|`) and `<code>` tags so permission patterns
display correctly in MDX. Update cross-document links from relative `.md` paths
to absolute Fern URL paths.
Improve roles-and-permissions with a Mermaid flowchart for the role hierarchy.
Refactor security-model and concepts pages for clarity and accuracy.
Add docs-watch.mjs, a file-system watcher that triggers Fern live-reload when
any file outside `docs/fern/` changes, and wire it up as `make docs-watch`.
Extend auth-tools.py with a `generate-docs` command that regenerates the
permissions reference from the auth configuration.
Signed-off-by: Ryan Sadler <267728323+ironcommit@users.noreply.github.com>
|`make docs-fix-links`| Auto-delink references into gated pages |
16
17
17
18
Local preview and the published site read the **same**`docs/fern/versions/latest.yml`, so what you see locally is what ships.
18
19
20
+
Use `make docs` when you are only editing `docs/fern/` config. Use `make docs-watch` when you are editing page content elsewhere under `docs/`, since it restarts the Fern dev server when repo-level docs files change outside `docs/fern/`.
21
+
19
22
## Rules that bite if you miss them
20
23
21
24
-**Navigation is the build.** Fern only builds pages listed in `docs/fern/versions/latest.yml`. A `.mdx` not in the nav is **not built** (404, not indexed) — that is how unready features are gated. Do **not** use `hidden: true` for gating (it still builds/serves the page).
Copy file name to clipboardExpand all lines: docs/auth/authorization/permissions-reference.mdx
+43-43Lines changed: 43 additions & 43 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,12 +2,12 @@
2
2
title: "Permissions Reference"
3
3
description: ""
4
4
---
5
-
(permissions-reference)=
6
5
6
+
{/* This page is generated from the auth configuration. Regenerate it with `uv run python services/core/auth/scripts/auth-tools.py generate-docs`. */}
7
7
8
-
Complete reference of all permissions across the NeMo Platform APIs. Each permission controls access to a specific operation within an individual API. Permissions are assigned to users through [roles](roles-and-permissions.md).
8
+
Complete reference of all permissions across the NeMo Platform APIs. Each permission controls access to a specific operation within an individual API. Permissions are assigned to users through [roles](/documentation/access-control/authorization/roles-and-permissions).
9
9
10
-
For token-level access restrictions, see [API Scopes](api-scopes.md). For the RBAC model, see [Authorization Concepts](../concepts.md).
10
+
For token-level access restrictions, see [API Scopes](/documentation/access-control/authorization/api-scopes). For the RBAC model, see [Authorization Concepts](/documentation/access-control/concepts).
11
11
12
12
<Note>
13
13
@@ -18,79 +18,79 @@ PlatformAdmin is omitted — it bypasses permission checks entirely at the polic
Copy file name to clipboardExpand all lines: docs/auth/authorization/roles-and-permissions.mdx
+22-9Lines changed: 22 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -41,19 +41,32 @@ NeMo Platform provides four predefined roles, each designed for a specific user
41
41
42
42
Each role includes all permissions of the roles below it:
43
43
44
-
```text
45
-
PlatformAdmin
46
-
▲
47
-
Admin (+manage_members, +change_visibility)
48
-
▲
49
-
Editor (+create, +update, +delete, +cancel)
50
-
▲
51
-
Viewer (list, read, inference)
44
+
```mermaid
45
+
flowchart BT
46
+
Viewer["Viewer
47
+
+list
48
+
+read
49
+
+inference"]
50
+
Editor["Editor
51
+
+create
52
+
+update
53
+
+delete
54
+
+cancel"]
55
+
Admin["Admin
56
+
+manage members
57
+
+change visibility"]
58
+
PlatformAdmin["PlatformAdmin
59
+
all workspaces
60
+
all operations"]
61
+
62
+
Viewer --> Editor
63
+
Editor --> Admin
64
+
Admin --> PlatformAdmin
52
65
```
53
66
54
67
## Permission Matrix
55
68
56
-
Rows are operations; columns are roles. A checkmark indicates the role has permission.
69
+
Rows are operations; columns are roles. Read the hierarchy above first: each role inherits everything below it, and the tables call out the points where additional privileges appear.
PlatformAdmin["PlatformAdmin<br/>all operations across all workspaces"]
78
+
79
+
Viewer --> Editor
80
+
Editor --> Admin
81
+
Admin --> PlatformAdmin
71
82
```
72
83
73
84
Custom roles can be defined at deployment time with arbitrary permission sets — they do not need to follow this hierarchy. For the complete permission matrix, see [Roles & Permissions](/documentation/access-control/authorization/roles-and-permissions).
@@ -118,19 +129,16 @@ A role binding contains:
118
129
-**Workspace**: The workspace where access is granted (e.g., `team-ml`)
119
130
-**Role**: The role being assigned (e.g., `Editor`)
Copy file name to clipboardExpand all lines: docs/auth/deployment/configuration.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,7 +37,7 @@ auth:
37
37
admin_email: "your-admin@company.com"
38
38
```
39
39
40
-
For a complete reference of all `auth` fields and their defaults, see the [platform configuration reference](/documentation/reference/configuration-reference). Auth-related values are found under `platformConfig.auth` in the values file.
40
+
This page covers the auth-specific configuration fields you need to enable and operate authorization. Auth-related values are found under `platformConfig.auth` in the values file.
41
41
42
42
For OIDC-specific fields (`auth.oidc`), see [OIDC Setup](/documentation/access-control/authentication/oidc-setup).
0 commit comments