DACore · coming December 2026
How DACore users, groups, and permissions work
DACore organizes access as users, permission catalogs owned by modules, and roles (the UI label is Groups) that bundle those rights. There is no separate tenant or “organization” table in DACore. If you need branches or companies, that is your module, registering its own rights on top of this core. What you get for free is a user desk, last-root protection, per-user IP and URL firewalls, and APIs so a plugin can create and later delete its own permission group without raw SQL.
Common mistakes
| Wrong | Right |
|---|---|
INSERT into users_rights* from your installer. |
DACore:Rights@createGroup!, @createRight!, @assign!. |
Use #DACore:AuthTest@check! as the permission gate for Shop routes. |
That middleware ignores the rights array you pass. Write Shop/Middleware/Rights.php. |
Name a right edit with no module column. |
Effective strings are {Module}.{rightname} — Shop.orders.edit. |
Strip dotapp.root from the last remaining root. |
DACore refuses. Keep one break-glass operator. |
| Treat URL firewall as a replacement for rights. | URL rules hide paths. Rights still decide the action when the path is allowed. |
The user desk
Operators with DACore.users.list (and related create/edit/root rights) get a searchable user list, a create form, and per-user tabs: Account, 2FA, IP firewall, URL firewall, Groups, Devices, Login history.
“My account” is the self-service slice, gated by DACore.user.profile.basic or .full.
Profiles live in dacore_users_profiles: display name, UI language (or follow the navbar locale), and JSON extras such as AI visibility and whether rights come from groups or manual assignment.
How a module registers rights
One creator, one group. createGroup is idempotent. createRight upserts on group + module + rightname.
Assign the installing operator so they can open the new screens immediately.
$groupId = DotApp::call('DACore:Rights@createGroup!', 'Shop', 'Shop');
$rightId = DotApp::call(
'DACore:Rights@createRight!',
$groupId,
'Edit orders',
'Change order status and notes',
'Shop',
'orders.edit',
'Shop'
);
DotApp::call('DACore:Rights@assign!', $userId, $rightId);
Uninstall calls DACore:Rights@deleteGroup! with the same creator string. That removes the catalog rows and the user assignments. Do not leave Shop.* ghosts in the database.
Groups (roles)
A role is a named bundle of rights. Saving a user in group mode copies the bundle into users_rights.
Manual mode is for exceptions. Do not invent a third rights table in your module.
Built-in DACore strings include dotapp.root, DACore.users.list / .edit / .create, DACore.users.roles, profile basic/full, DACore.admin.menu, DACore.admin.system, DACore.admin.installer.
Granting elevated permissions requires 2FA on that account, or the account is set inactive. That rule exists so a stolen password without a second factor cannot quietly become root.
Per-user firewalls
IP firewall: CIDR or a single address, allow or block, ordered, with a master switch on the user. Enforced at login. Admins drag-reorder rules. Self-service is available when the profile right allows it.
URL firewall: path patterns with * globs, compiled to regex, evaluated on every authenticated request.
A blocked path is a 403 through the configured error page — not a silent skip.
Use it to lock a contractor into /admin/shop/* without giving them Users. Still register Shop rights; the firewall is a second fence, not the only fence.
Enforcement in your routes
Wildcard Shop.* matches any permission that starts with Shop.. Literal lists are OR via Auth::can.
* means any logged-in user — fine for a “my profile” link, wrong for “delete all orders”.
Always re-check in the POST handler. A hidden button is not security. That is the same law as secure forms.
FAQ
Where is the organization entity?
Not in DACore. Model companies or branches as your own module with your own tables and rights. DACore organizes operators.
Why not AuthTest for Shop rights?
#DACore:AuthTest@check! is the CRC/session gate. It does not apply the rights array you wish it did. AIRULES-DACORE calls this out because agents copy the DACore middleware name and think they are done.
When do rights change without logout?
On the permissions auto-refresh interval, and when an admin saves the user. Do not cache a stale “can edit” flag in DSM across hours.