Multiple users and roles for the same account

[metmarkosaric]

"As a company, giving out the username and password to every employee which needs to access the data is not very friendly, also we don’t want all employees to see all properties, plus if someone leaves, we have to reset the password and update everyone with the new passport… Please give the option of multiple users 😍"

Update: You can now invite team members to view the stats and manage the sites you have added to your account. Learn more about users and roles.

You can now also transfer the ownership of a site to a different Plausible account. See how the site ownership transfer works.

[metmarkosaric]

From #327 :

Two roles would be sufficient:

• Admin, everything is allowed (including removing another admin)
• Viewer, a read-only access to the account

[Eptis]

I'm interested in contributing to this feature. If I understand correctly, this feature is about allowing multiple accounts under a site with different permission settings based on a Role model. This feature would involve:

• Adding a role property to the membership model/table which could contain either "ADMIN" or "VIEWER"
• Add an endpoint to allow the invitation of users to a site with a given Role. Calling this multiple times for the same user should send a re-invite.
• Add an endpoint to allow the updating of user roles of a site. It should only be allowed by an ADMIN.
• Add an endpoint to remove a user from a site.It should only be allowed by an ADMIN.
• Update the UI to allow the invitation of users to a site, with a given Role
• Update the UI to allow the editing of users of a site. It should allow an ADMIN to change the roles of certain accounts
• Update the UI to allow the removal of users of a site. It should only be allowed by an ADMIN.

I based this on a quick glance through the codebase so not sure if this list is comprehensive.

[ukutaht]

@Eptis That looks good to me.

I could see some sort of support for teams/organizations as well but that can be added on top later on.

We also need to think about how this feature interacts with the billing system on Plausible Cloud. When there are multiple admins on a site, who gets billed for it? I'm thinking that we need an 'OWNER' role with a rule being that every site has one and only one owner.

[Eptis]

Good point. I think using 'OWNER' as a role might be problematic in terms of ensuring only 1 account is used for billing, but I could be mistaken. Would a new relation similar to membership be an option? 'Ownership' could be introduced in a separate table. What do you think? It would probably be easier to link this to a team/organisation later on in the case of billing.

[Eptis]

A different option would be to store the Account ID that owns the site in the 'sites' table itself but that might mix concerns

[Eptis]

Also, what is the best way to run all the databases required 😬 ?

[ukutaht]

@Eptis You're right, I like your idea of adding a owner_id to the site record so we can enforce the constraint on the db level.

We would need the app then to make sure that the owner is never deleted from the list of members.

Also, what is the best way to run all the databases required 😬 ?

I run postgres on my MacOs natively via homebrew and Clickhouse via Docker: https://hub.docker.com/r/yandex/clickhouse-server/

If you're going to get set up on your machine, would it be too much to ask to also document the process? I'd love to offer a CONTRIBUTING.md doc to new contributors like yourself. Don't feel obligated to write the doc but it would be a great help :)

[Eptis]

Ok owner_id it is!

I'll document the process and maybe add a makefile to hide-away some of the docker commands to run it.

[Eptis]

I think I missed something in the TODO list above. I believe it should also allow the invitation of users and allow them to register a new account. Is there already something in place for this?

[metmarkosaric]

True, as an admin you would need to be able to invite people to the account. We don't have that functionality at this stage.

[Eptis]

I made a first attempt as this feature but the size and impact of it are becoming larger and larger. Also I don't have time until next year to work on this. Maybe this is useful for you and you (or someone else) could continue the effort. I made a draft PR here: #432

[metmarkosaric]

More feedback on this with a specific usecase and need for user accounts:

"If you implement it using a viewer, admin and owner setup, then everything is great. Then it would be possible to create the sites for the clients, set everything up for them and invite them as an administrator and then transfer the ownership of the site to their account so they get the responsibility of billing, but with them having zero need to care about the setup of the site.

I feel this is a common use case and needs to be possible, it's going to be a real struggle to get the non tech-savvy customers to create the accounts and invite the developer afterwards as administrator, my experience is that this can usually take way longer than you would think, and require so much explaining and hand holding, even for what we see as super simple things.

The private links is what I am using now, but it's not a good long term solution, since it means the developer/agency takes ownership of the clients data in a way that makes the client unable to take full control if they wish, this doesn't fit well with the overall privacy goals of Plausible."

[ukutaht]

Never thought about this use-case. Definitely very useful as we are starting to attract less technical audiences.

[ryan-mahoney]

Even very technical users are interested in this feature :)

[cdedreuille]

Is there any update on this feature? In our case, we would love to be able to have. multi-users account for them to be able to access it simply by going to Plausible, sign in with SSO (Google). It's much easier to remember plausible.io than the link with a password.

[metmarkosaric]

thanks @cdedreuille! All our development is done in the open. We haven't started on this work yet and I cannot promise any specifics on when this will be done. At the moment, our focus is on the API. User accounts is one of the most requested features and we want to build it but we're a small team with limited resources so need to focus on things one step at a time

[mffap]

Speaking of SSO: Will it be possible to use an existing IDP (such as Google, or any OpenID Connect Provider)? I would love to re-use my existing company account to log into plausible.

[ukutaht]

We'll be going live with basic collaboration features to start with (see #176 (reply in thread)). More advanced features like 2FA and SSO will stay on our roadmap, we intend to implement them but sorry I can't provide a timeline at this time.

[metmarkosaric]

Not in the first round (we're about to release the user accounts/levels shortly) but SSO is something we plan to look at in the future. We will try not to use Google but it remains to be seen as we haven't even started on this.

[mffap]

Hi @metmarkosaric, we are trying out your service for zitadel.ch and loving it so far!

I wanted to add a colleague to the dashboard, thus I stumbled on this conversation. If you are interested, we are developing the Identity & Access Management Solution ZITADEL. I think we might offer some interesting things out of the box for you besides authentication, such as granting organizations to self-manage their roles, identity brokering (social, company account etc). If you're interested to collaborate, feel free to get in touch!

[neuromusic]

Just want to cast an extra vote for this! We're a small team now, but already running into challenges as our engineers need to be able to log in and define new goals or get API credentials without bothering the account owner, who is mainly just responsible for billing.

[ukutaht]

Yeah I'm working on this as we speak. It won't be a full-fledged organization accounts (in the style of Github) but more like basic collaboration features to start out with:

• Site has one owner who is responsible for billing.
• Owner can invite other users to a site by email address. Members can be admin or viewer
• Admins can access site settings, viewers can only see the stats
• The owner can also choose to transfer ownership to another account

I'm specifically making sure that we don't reveal whether the person being invited already has an account or not. Plausible accounts are not public profiles and we don't want people to be able to search whether a certain email address / company domain is in our database.

[cdedreuille]

I believe this will cover already a lot of use cases. Can't wait for this.

[neuromusic]

Great news!!! Thank you so much for the updates @metmarkosaric & @ukutaht 🥰

[neuromusic]

@ukutaht how will API credentials work with the permissions system? Would I be correct in assuming that owner, admin, and viewer roles can all generate tokens for the stats API, but only owners can generate tokens for the site provisioning API?

[ukutaht]

Thanks @neuromusic

Currently API keys are associated with users not sites. Anyone can create any API key for their account regardless of whether they have 0 or 100 sites or whatever roles they have on those sites.

The role-based access will be enforced the same way as through the UI. For example, even if I'm just a viewer on one site, I could still create a site provisioning API key for my account and create new sites that I will own. However, I won't be able to change the settings of the site where I'm a viewer on because I don't have that kind of access. Does that make sense?

[metmarkosaric]

And we're live with this! 🎉

You can now invite team members to view the stats and manage the sites you have added to your account. Learn more about users and roles.

You can now also transfer the ownership of a site to a different Plausible account. See how the site ownership transfer works.

[johanrosenson]

Great to see this live, just tested it out and it seems to be working as expected! :)

One thing that could be improved is to make it easier to see which sites are counted for my account and which are not.
Now when I'm loooking at /sites it not clear which sites count for my monthly quota and which sites are being payed for by someone else.
Maybe a listing of sites could be added to /settings page together with the current Your usage section.

[ukutaht]

Maybe a listing of sites could be added to /settings page together with the current Your usage section.

Yeah that makes total sense to get a better breakdown.

I thought about adding a little badge on each site on the /sites page to show your role on that site (viewer, admin or owner). It looked quite busy though and not so great for the majority of users who only own sites.

Another thought I had was to break the /sites page up into two sections:

1. My sites
2. Other(?) sites

or something like that.

Thoughts?

[neuromusic]

not so great for the majority of users who only own sites.

I suspect this will start changing soon, as teams like ours start adding more new users who don't own any sites but are admins on a few.

[johanrosenson]

Another thought I had was to break the /sites page up into two sections:

My sites
Other(?) sites
or something like that.

Thoughts?

Looks like a good idea, but instead of grouping all other under "Other" i think it needs to be

1. My Sites
2. Owner A
3. Owner B
4. and so on

I like the badge idea also, but I don't think we have to choose only a single solution, all solutions suggested would work great together.

[artistro08]

How would I get this working for a self hosted account?

[jurjendevries]

@artistro08 I am new to Plausible but by reading I found out "Self-hosted analytics will become a twice a year, long term release", which is a bit different than the paid hosted solution which comes with "Continuously developed and improved with new features and frequent updates.". Source https://plausible.io/self-hosted-web-analytics
Looking at https://github.com/plausible/analytics/releases you can find the current and past releases. Seems the devs even did a bit more. Last one was in April, so who knows another one soon :-)

[ActiveByte]

Also waiting for it!

[ukutaht]

@ActiveByte Self-hosted version 1.4.0 is now released which has this feature

[sjuranek]

I'm up to around 10 sites and want to add others to all of them. Is there a way to do this yet? I'm not seeing anything so hoping I can add a co-admin with sharing an email/pwd. I'm a cloud subscriber, fyi.

[metmarkosaric]

hi @sjuranek! we do support team members and user roles already. you can see how it works here: https://plausible.io/docs/users-roles