Teams and access

Every function belongs to exactly one team. The console is scoped to one team at a time — the team picker is the entry point, and each URL is /<team-slug>/….

The model is deliberately small: three roles, no per-function permissions, no nested teams, no organisation layer. Identity comes from your Xeonr Auth session.

Roles

Roles are cumulative: an owner can do everything an editor can.

Members

Owners invite members by email. An invited member is pending until they sign in for the first time; from then on the membership is anchored to their identity rather than to the address, so a later email change at the identity provider does not lose it.

A team keeps at least one owner — the last one cannot be demoted or removed.

API tokens

Tokens are how CI deploys without a browser.

curl -X POST https://functions.xeonr.io/xeonr.functions.v1.FunctionService/DeployFromGit \
  -H "Authorization: Bearer fnt_…" \
  -H "content-type: application/json" \
  -d '{"functionId": "fn_…"}'

A token is created by an owner, and:

• Belongs to one team, with one role — editor or viewer. Never owner: a token that could mint more tokens would make revocation meaningless.
• Cannot reach team management. Tokens authenticate the function API only, so a token leaked in a pipeline log is worth "deploy into one team", not "own it".
• Is shown once. Only the hash is stored, so the value in the create response is unrepeatable by design. Lost tokens are replaced, not recovered.
• Records when it was last used, which is what makes an unused token safe to revoke.

Revoke a token by deleting it; it stops working immediately.

Activity

Every change is recorded with who did it, against which function, and when. The actor is an email address for a person, token:<name> for an API token, or webhook:<provider> for a push.

Recorded actions include:

function.create   function.update   function.delete
function.deploy   function.promote  function.redeploy
git.connect       git.select_repo   git.disconnect
files.edit
team.create       team.rename
member.upsert     member.remove
token.create      token.delete

Administrators bypass role checks but not the audit trail — an admin acting is still recorded as themselves.