Overview

Wiki.js has a powerful permission system with fine grained control over what your users can see and do.

Permissions are managed at the group level.

• Until a user is assigned to a group, that user is not allowed to view or do anything.
• A user can be part of one or more groups.
• A group can have multiple page rules and a set of global permissions.
• A group without any page rule isn't allowed to view or do anything.

Page Rules

Page rules specify what a user can do on one or more pages, whether it's viewing a page, making edits, upload assets or posting comments. They are optionally tied to specific sites and locales.

A page rule consists of the following elements:

• Enforcement Mode
• Permissions
• Site Filter
• Locale Filter
• Matching Pattern

Enforcement Mode

The enformement mode determines whether the rule grants or deny permissions.

• Allow: Grant the ability to perform the selected actions unless overriden by a Deny rule of the same specificity. (lowest priority)
• Deny: Deny the ability to perform the selected actions. This overrides an Allow rule of the same specificity.
• Force Allow: Grant the ability to perform the selected actions, bypassing any Deny rule of the same specificity. (highest priority)

Permissions

One or more permissions can be selected for a page rule:

Name	Key	Description	Note
Read Pages	read:pages	Can view and search pages.
Write Pages	write:pages	Can create and edit pages.
Review Pages	review:pages	Can review and approve edits submitted by users.
Manage Pages	manage:pages	Can move existing pages to other locations the user has write access to.
Delete Pages	delete:pages	Can delete existing pages.
Use CSS	write:styles	Can insert CSS styles in pages.
Use JavaScript	write:scripts	Can insert JavaScript in pages.	Use with caution as users could inject malicious scripts.
View Page Source	read:source	Can view the pages source.
View Page History	read:history	Can view previous versions of pages.
View Assets	read:assets	Can view / use assets (such as images and files) in pages.
Upload Assets	write:assets	Can upload new assets (such as images and files).
Manage Assets	manage:assets	Can edit and delete existing assets (such as images and files).
Read Comments	read:comments	Can view page comments.
Write Comments	write:comments	Can post new comments on pages, edit and delete their own comments.
Manage Comments	manage:comments	Can edit and delete any existing page comments.

Site Filter

A site filter can be applied to limit the page rule to only specific sites instead of all sites.

Locale Filter

A locale filter can be applied to limit the page rule to only specific locales instead of all locales.

Matching Pattern

Select how this page rule will match pages:

• Path Starts With... (lowest priority)
• Path Ends With...
• Path Matches Regex...
• Has Any Tag...
• Has All Tags...
• Path is Exactly (highest priority)

Important

• Don't include a leading slash / for Path Starts With... and Path is Exactly...
• Don't include the leading and trailing slash / for Path Matches Regex

Specificity

Rule specificity specifies which rule wins over another when they apply to the same page. The page with the highest specificity always win.

The specificity is determined in order by:

• Path (highest specificity)
• Matching Pattern
• Enforcement Mode (lowest specificity)

In other terms,

1. A longer path takes precedence over a shorter path.
2. If the 2 rules match the same path, the priority is given based on the matching pattern.
3. If 2 rules match the same path and use the same matching pattern, the enforcement mode with the highest priority wins.

Examples

Example 1 - Path

Assuming you have 2 rules:

Rule 1	Deny	Path starts with foo
Rule 2	Allow	Path starts with foo/bar

Rule 2 wins because the path is more specific than Rule 1.

Example 2 - Pattern Matching

Assuming you have 2 rules:

Rule 1	Deny	Path starts with foo/bar
Rule 2	Allow	Path is Exactly foo/bar

Rule 2 wins because the matching pattern is more specific than Rule 1.

Example 3 - Enforcement Mode

Assuming you have 2 rules:

Rule 1	Deny	Path starts with foo/bar
Rule 2	Allow	Path starts with foo/bar

Rule 1 wins because a Deny overrides an Allow when everything else is the same.
This use case mostly happens when a user is part of 2 groups, where one has Allow and another has Deny on the same path.

Global Permissions

Global permissions represents administrative actions a user can perform. They are not tied to specific pages or sites.

Name	Description	Note
access:admin	Can access the administration area.	This permission should be granted to anyone with one or more of the permissions below.
read:users	Can view users, but not create or modify.
manage:users	Can create / manage users.	Cannot modify users with manage:system permissions.
read:groups	Can view groups and their permissions, but not create or modify them.
manage:groups	Can create / manage groups and assign permissions / page rules.	Cannot modify groups with manage:system permissions.
read:audit	Can read the audit log, i.e. the record of what everybody on this wiki has done.	Usually granted for security auditors.
read:metrics	Can scrape the Prometheus metrics endpoint from an address it is not open to anonymously.	Usually for use by APIs and automations.
manage:navigation	Can manage site navigation
manage:theme	Can modify site theme settings
manage:sites	Can create / manage sites
manage:system	Can manage and access everything. Root administrator.	Use with caution when assigning this permission. This should normally not be assigned to anything other than the system administrator.