Users and Privileges

Pipe Bomb supports multiple users. Each user has a username, password, and a set of granted privileges that control what they can do.

User roles

Owner

The owner is the first account created during the Installation. There is one owner; they have full access to everything and cannot be demoted. The owner account is flagged in the database (isOwner = true).

If the ADMINS environment variable is set to a list of user UUIDs, those users are automatically promoted to owner on the next server start.

Regular users

All other accounts are regular users. What a regular user can do is controlled entirely by their privilege grants.

Privileges

Privileges are named capabilities. The server registers system privileges; plugins cannot yet register additional privileges tied to their own features.

The special privilege * (wildcard) grants all privileges - it is equivalent to full admin access for a regular user.

Managing privileges

Admins can manage any user's privileges from Settings → System → Users. The privilege list shows:

  • Each privilege key and which plugin it belongs to (system or plugin ID)
  • Whether it is directly granted or granted by inclusion
  • The parent privileges that include it

Authentication

Users log in with username and password. The server uses scrypt for password hashing. Successful login returns a JWT that the frontend stores and sends with every API request.

Plugins can request auth tokens on behalf of users via the auth client (ctx.requestAuthClient()), which lets plugins generate and validate JWTs for their own flows. Plugins cannot view or change user passwords.

Multi-user considerations

  • Playlists have visibility settings (public/private) and collaborator lists - see users/Playlists
  • Each user can have separate per-plugin configuration via user config managers
  • The ADMINS environment variable is a migration path for early setups; once owners are in the database, it can be removed