Users & Roles

Baan supports multiple users with role-based access control. All users authenticate against the same admin URL and share the same login flow — the role determines what they can do once inside.

Roles

Baan defines three roles, each with a fixed set of permissions:

Role	Intended use
Admin	Site owner. Full access including user management and settings.
Editor	Contributors. Can create, edit, and publish content but cannot change site configuration.
Viewer	Read-only access. Useful for stakeholders who need to see analytics without touching content.

Permission Matrix

Capability	Admin	Editor	Viewer
View posts	✓	✓	✓
Create / edit posts	✓	✓	—
Delete posts	✓	✓	—
Manage media	✓	✓	—
View analytics	✓	✓	✓
Manage users	✓	—	—
Change settings	✓	—	—
Import content	✓	—	—

Password Rules

Passwords are hashed with bcrypt before storage. Initial setup enforces:

• Minimum 8 characters
• Mix of letters and numbers
• Rejection of commonly leaked / weak passwords

Plaintext passwords are never logged, stored, or returned in API responses.

When adding or updating users later, the API enforces a minimum password length and stores only the bcrypt hash.

Account Safety

Two structural safeguards prevent admins from locking themselves out:

• The last Admin cannot be deleted. Baan checks the role count before any user delete and refuses if it would leave zero admins.
• You cannot delete your own account. Self-delete is blocked from both the UI and the API.

To “remove” yourself, first promote another user to Admin, log in as them, and then delete the previous account.

Authentication

Login uses an access token (60-minute lifetime) plus a refresh token (30-day lifetime). Tokens are signed with HMAC-SHA256 and stored in HttpOnly cookies with the __Host- / __Secure- prefix. Login attempts are rate-limited.

For threat model details, see Security.