Skip to main content

​
Overview

Teams allow multiple users to share encrypted data (KV store entries, Git repos) with fine-grained role-based access control. Teams can span multiple FOKS servers, and teams can be nested — a team can itself be a member of another team.

​
Roles

The member role carries a signed integer sub-level n in the range -16384 to 16384, defaulting to 0 (written as plain member). Sub-levels are linearizable: member(-1) is lower privilege than member(0), which is lower than member(1). This is useful for granting bots or automated processes a distinct privilege tier within the member band — for example, a deploy bot might be member(-1) to ensure it can only access data explicitly shared at that level or below.

​
Commands

​
create

Create a new team. The creating user becomes the owner.

​
invite

Generate an invite code for a team. Share the code with intended recipients via any channel (email, chat, etc.). Requires admin role or above.
The same invite code can be used by multiple people.

​
accept

Accept a team invite using the code shared by an admin.

​
admit

Admit a party (user or team) that has previously accepted an invite. Optionally specify a role; defaults to member.

​
add

Add a user directly to a team on an open-view host (where user listings are public). Requires admin role or above.
On closed-view hosts, use invite + admit instead.

​
change-roles

Change the role of one or more users in a team. Changes are specified as user@host/newrole. To remove a user, set the role to none.

​
list

List the members of a team.

​
list-memberships

List all teams the current user is a member of.

​
index-range

Low-level team index range management. Used for administrative purposes.

​
Federated Teams

Teams can include members from different FOKS servers. When inviting a user from another server, use their fully-qualified name:
For example:

​
Nested Teams

A team can be added as a member of another team. This allows hierarchical permission structures. For example, an infrastructure team could be a member of a platform team with read access to platform secrets.