Roles and Permissions #

Overview #

Pragma’s Roles and Permissions system provides fine-grained access control for Operators and Partners. Roles are collections of permissions that define access to specific portal features, RPC endpoints, and Player Data operations. Assigning roles ensures Operators and Partners only have access to the actions relevant to their responsibilities.

Authentication and Session Types #

Pragma supports two types of authenticated sessions that use permissions: Operator and Partner sessions.

  • Operator Sessions: Used for tasks performed within the Operator portal and require both authentication and an assigned role with the appropriate permissions.
  • Partner Sessions: Used by trusted third parties, such as game servers, and are not tied to a specific account. Instead, permissions are defined directly within the Partner token.
See the Generate Partner Tokens guide to assign permissions to a partner token.

Roles #

Roles are collections of permissions that can be assigned to accounts. Pragma includes a default Admin role with access to all permissions that cannot be modified or deleted.

Creating a role #

  1. From the Social Operator Portal, click Accounts, then Roles.
  2. Click the Create Role button to create a new role.
  3. Click the Add Accounts button to add accounts to the role.
  4. Switch to the Permissions tab and click Update Permissions to add permissions to the role.

Permissions #

Permissions define access to RPC endpoints and Player Data operations. Each permission follows a hierarchical format: service.resource.action (e.g. account.accounts.get), and a single permission may cover multiple related RPC endpoints. For instance, the account.account_groups.update permission includes both adding and removing accounts to a player group endpoints.

Custom permissions can be defined on Custom Services or custom Player Data operations. Once defined, they are automatically available for assignment to roles.

RPC Endpoint Permissions #

RPC endpoint permissions are defined using the @PragmaRPC annotation in the code:

@PragmaRPC(
    sessionType = SessionType.OPERATOR,
    permission = "account.accounts.get"
)
suspend fun getPragmaPlayerOverviewsOperatorV1(
  operatorSession: OperatorSession, 
  request: AccountRpc.GetPragmaPlayerOverviewsOperatorV1Request
): AccountRpc.GetPragmaPlayerOverviewsOperatorV1Response

Player Data Operation Permissions #

Player Data operation permissions are defined using the @PlayerDataOperation annotation:

@PlayerDataOperation(
    sessionTypes = [SessionType.OPERATOR, SessionType.PARTNER],
    permission = "virtual_currency.currency.get"
)
fun getPlatformBalance(
  request: GetPlatformBalanceRequest, 
  context: Context
): GetPlatformBalanceResponse

Automated Role Assignment #

The account plugin can be used to automate role assignment like assigning a specific role to users in a designated Google Group.


Privacy Rights
How-To Guides