Owners, sharing and who can see a board
Deckgauge has two things people call "owners", and they don't overlap: who can open a board at all, and the list of names available in a row's Owner field. Keeping them apart avoids a common mix-up.
Access list with roles; a new user being added as Editor.
Board access: who can open the board
Sharing a board grants a Keycloak-authenticated user one role — Owner, Editor, or Viewer — searched by name or email against your local user directory. A board always has at least one Owner: the last one can't be removed, and revoking it is rejected until another Owner exists.
Each role is now a real write barrier, enforced server-side on every request — not just a statement of who belongs on the board. Viewer can read the board, its groups and rows, its dashboards, and its roadmap view, and nothing else. Editor can do everything a Viewer can, plus create, change, and delete rows, groups, columns, statuses, comments, uploads, and automations, and change the board's column layout and hidden-field settings. Owner can do everything an Editor can, plus grant, change, or revoke other people's access, and delete the board outright. A board only appears in your board list, and only opens, for a signed-in user who holds an access row on it — everyone else gets a not-found. Every one of these checks lives behind a declared authorization policy the server verifies before a route's own handler runs; the API refuses to start at all if a route is missing one, so there's no route left relying on the UI alone.
The Owners list: names for the Owner column
Separately, each board keeps its own Owners list — nothing more than names and colors, managed from the board's settings drawer. This is what powers the autocomplete in a row's Owner field; it has nothing to do with who can log in or what they're allowed to do. Add, rename, recolor, or delete an entry here without touching anyone's access to the board.
How to share a board
- Open Share — from the board header.
- Search for a user — by name or email.
- Pick a role — Viewer, Editor, or Owner — then Add.
- Revoke access — remove any entry except the sole remaining Owner.
Under the hood
Users authenticate via Keycloak OIDC; the account you search for and share with is the local user record created from that login, not a Keycloak group or role directly. All of the above assumes a normal, multi-user deployment: a DECKGAUGE_SINGLE_USER=true instance skips every one of these checks, roles included — see Configuration reference.
If it looks wrong
| Symptom | Cause | Fix |
|---|---|---|
| "Cannot remove the last board owner" | You tried to revoke the only remaining Owner | Grant Owner to someone else first, then revoke |
| Can't find a person in the Owner field's dropdown | They're not in this board's Owners list yet | Add them from the board settings drawer — separate from sharing |
| A shared user can't see the board at all | They have no access row on it — the share wasn't saved, or they signed in under a different account | Search for them again in Share and add them at Viewer or above |
Related
- Board settings — where the Owners list lives.
- Access & security — Keycloak and role-based access across the whole app.
Last updated