Roles

A role groups users. It decides how their name looks (colour and prefix), what they may upload and edit on their profile, and, through staff permissions, whether they are administrators or moderators.

Read a user's roles in an API routeCopy Anchor Link

getUserRoleIds returns every role id a user holds, primary and secondary, without duplicates. It reads the database on each call:

import { getUserRoleIds } from "@vitnode/core/api/lib/check-staff-permission";

// inside a route handler, where `c` is the Hono context
const user = c.get("user");
const roleIds = user ? await getUserRoleIds(c, user) : [];

Seeded rolesCopy Anchor Link

A fresh install gets four protected roles:

Role fieldsCopy Anchor Link

core_roles holds:

• color: a CSS colour (#ff0000, hsl(210, 100%, 50%)) applied to members' names across the UI.
• prefix: an emoji or a Lucide icon shown before the role name and every member's name. Stored as emoji:🚀 or icon:rocket; the Emoji & Icon Picker covers the format and the components that read it.
• root: when true, members pass every staff permission check.
• default: the role new members get.
• guest: the role used for visitors who are not signed in.

Roles also carry allowances: file uploads and editing, deleting and hiding own content on the Content tab, and personal information, Browse anonymously, and avatar and cover limits on the Profile tab. Profile fields, User Presence and Avatars and covers explain how several roles combine.

Editing own contentCopy Anchor Link

Allow editing own content (on by default) lets members of the role edit the comments, topics and other Content Engine records they wrote from the site. Under it, Time to edit sets how many minutes after posting the edit stays open, or tick Unlimited to keep it open forever. Once the time runs out, Edit disappears from the member's comments and the API answers edit_window_closed.

Two more switches, both off by default:

• Allow deleting own content puts Delete on the member's own comments. A deleted record cannot be restored. A comment that has replies stays in the thread as a [deleted] placeholder reading "Comment deleted by user", so its replies keep their place.
• Allow hiding own content puts Hide on them. A hidden record disappears for everyone else; the member still sees it and can Unhide it. If a moderator hid it, it stays hidden.

With several roles the most generous one wins: each action is allowed when any of the member's roles allows it, and the longest time to edit applies, with Unlimited beating any number. A forum board's own edit window still applies on top, so both have to allow the edit.

Moderators don't need any of this. Every content type members write gets moderator permissions in AdminCP → Staff → Moderators, such as Edit any comment, Delete any comment and Hide and unhide comments, which work on everyone's content at any age.

Primary and secondary rolesCopy Anchor Link

Every user has exactly one primary role (core_users.roleId) and any number of secondary roles (core_users_secondary_roles). VitNode combines staff permissions across all of them. Staff change both in the Roles card on the user's AdminCP page (Manage users).

Manage roles in the AdminCPCopy Anchor Link

Roles live at AdminCP → Core → Users → Roles (/admin/core/users/roles). The table shows each Role, its Number of users and when it was last updated. Create role and the edit button open a dialog with General, Content and Profile tabs, plus Artificial intelligence (AI) when AI is configured. General holds the Name, the Color that tints member names, and the Prefix.

Deleting a role that still has users asks which role to move them to first.

RelatedCopy Anchor Link