Links between User Module and Other Modules

This document showcases the module links defined between the User Module and other Commerce Modules.

Summary#

The User Module has the following links to other modules:

RBAC Module#

You assign roles to admin users to control their access. Medusa stores each of these grants as an RbacRoleAssignment record in the RBAC Module, then exposes the roles of an admin user or an invite through read-only links.

An admin user can have multiple roles, and a role can be assigned to multiple users. The user's effective policies are the union of the policies from all their unscoped role assignments. A scoped assignment only adds its role's policies to requests within that scope.

Retrieve with Query#

To retrieve the roles of a user with Query, pass rbac_roles.* in fields:

The rbac_roles field doesn't include the scope of each assignment. To retrieve it, pass user_role_assignments.* in fields instead.

To find the users a role is assigned to, query the rbac_role_assignment entity and filter by the role's ID and by reference: "user".

Manage Role Assignments#

To assign a role to an admin user, use the assignRolesWorkflow:

import {
  assignRolesWorkflow,
} from "@medusajs/medusa/core-flows"

await assignRolesWorkflow(container).run({
  input: {
    assignments: [
      {
        role_id: "role_123",
        reference: "user",
        reference_id: "user_123",
      },
    ],
    granting_actor_id: "user_456",
  },
})

To remove a role from an admin user, use the unassignRolesWorkflow with the same input shape.

Invite Roles#

An invite can grant roles to the admin user created when someone accepts the invite. Medusa stores these grants as RbacRoleAssignment records whose reference is invite.

To retrieve the roles of an invite with Query, pass rbac_roles.* in fields:

const { data: invites } = await query.graph({
  entity: "invite",
  fields: [
    "rbac_roles.*",
  ],
})

// invites[0].rbac_roles

To set an invite's roles when you create it, pass the roles parameter to the Create Invite API route, as explained in the RBAC API Routes guide.

Learn more in the RBAC Module's links documentation.