ChannelAdmin Access Control
ChannelAdmins are a middle tier in the access hierarchy, sitting between SuperAdmins and TenantAdmins:
SuperAdmin > ChannelAdmin > TenantAdmin
A Channel represents a channel partner or reseller that owns a group of tenants. A ChannelAdmin can manage every tenant inside the channel (or channels) they administer, but has no visibility into tenants outside those channels. This page describes what a ChannelAdmin can and cannot do, and how the platform enforces that scope.
ChannelAdmin is user type 5. Like a SuperAdmin, a ChannelAdmin has no tenant of its own (tenantId is null) and selects a tenant to work in from the top navigation bar. Unlike a SuperAdmin, the tenants it can select are limited to those belonging to its channels.
This page covers the ChannelAdmin role — what a channel administrator sees and can do. For the SuperAdmin side — creating channels, assigning tenants to them, and appointing channel admins — see Channel Management.
Role Comparison
| Capability | SuperAdmin | ChannelAdmin | TenantAdmin |
|---|---|---|---|
| View all tenants | Yes | Only tenants in their channel(s) | No (own tenant only) |
| Switch tenant context | Yes (dropdown) | Yes (dropdown, channel-scoped) | No (locked to own tenant) |
| Manage channels | Full CRUD | Read-only (channels they administer) | No access |
| Create channels | Yes | No | No |
| Appoint channel admins | Yes | No | No |
| Manage tenants | All tenants | Create/edit within their channel(s) | No |
| Move a tenant between channels | Yes | No | No |
| Manage edges, connectors, devices | All tenants | Within their channel's tenants | Own tenant only |
| Manage users | All tenants, all types | Within their channel's tenants (no SuperAdmin/ChannelAdmin) | Own tenant, VPN users |
| Register tenants with Global VSA | All tenants | Their channel's tenants | No |
| Alerts settings | Read/write | Read-only | Per-tenant |
| Dashboard | Cross-tenant aggregate | None (redirected to Channels) | Own tenant |
| Assume identity | Yes (env-gated) | No | No |
Landing Page and Navigation
A ChannelAdmin does not have a dashboard. When no tenant is selected, the platform routes them to the Channels page (/admin/channels), which is their home base.
Sidebar in the No-Tenant State
When no tenant is selected in the topbar, a ChannelAdmin's sidebar is trimmed to just two items:
- Channels (
/admin/channels) -- the list of channels they administer - Tenants (
/admin/tenants) -- the tenants across their channels
There is no Home/Dashboard, no Equipment group, and no Shared Gateways in this state. Once a tenant is selected from the topbar, the standard tenant-scoped menu groups appear, scoped to that tenant.
A ChannelAdmin makes the rest of the application usable by opening a channel, then clicking Manage on one of its tenants. This sets the tenant context in the topbar and loads the tenant-scoped views (Edges, Connectors, Users, and so on) for that tenant.
Channels
The Channels page lists only the channels the ChannelAdmin administers. For a ChannelAdmin this list is read-only -- there are no Add, Edit, or Delete controls.
Opening a channel shows its detail page with two tabs available to a ChannelAdmin:
| Tab | Available to ChannelAdmin | Purpose |
|---|---|---|
| Overview | Yes | Channel name, status, and summary |
| Tenants | Yes | The channel's tenants; the primary workflow |
| Administrators | No (SuperAdmin only) | Assign/remove channel admins |
The Tenants tab is the main working area. From here a ChannelAdmin opens a tenant (via Manage) to administer its resources.
Creating channels and appointing channel admins are SuperAdmin-only operations — a ChannelAdmin cannot widen its own scope. See Creating & Managing Channels for that workflow.
Tenants
Within their channels, a ChannelAdmin can create and manage tenants:
- Create a tenant -- the tenant is automatically assigned to the ChannelAdmin's channel. If they administer more than one channel, they must choose which one; they cannot create a "Direct" (channel-less) tenant. Naming a channel they do not administer is rejected.
- Edit and delete tenants -- limited to tenants within their channels. The Channel field is not shown on the edit form: moving a tenant to another channel is SuperAdmin-only, and the API refuses the change if one is attempted. A ChannelAdmin who could move a tenant could push one out of their own scope, or pull someone else's in.
- Register a tenant with Global VSA -- a ChannelAdmin may register their own channel's tenants. See Tenant Approval.
Tenants with no channel assignment (channel_id is NULL) are "direct" tenants, visible only to SuperAdmins. A ChannelAdmin never sees them, even in the tenant selector.
User Management
When a ChannelAdmin has no tenant selected, the Users page shows a "Select a tenant to manage its users" prompt with a shortcut to Channels, rather than a cross-tenant view.
After selecting a tenant, a ChannelAdmin can invite and manage users within that tenant, with two limits:
- They cannot create SuperAdmin or ChannelAdmin accounts. Only a SuperAdmin can invite a ChannelAdmin (from the SuperAdmin "Channel Admins" view).
- Invitations are scoped to tenants inside their channels.
See Invitations & Provisioning for the invite workflow.
Tenant-Scoped Pages
For every tenant-scoped feature -- Edges, Connectors, Devices, System Settings, Email Templates, Roles -- a ChannelAdmin operates on the tenant currently selected in the topbar, exactly like a SuperAdmin working in a specific tenant. The one exception is Alerts settings, which are read-only for a ChannelAdmin.
Route Guards
The UI enforces ChannelAdmin scope at the routing level:
| Guard | Behavior |
|---|---|
| ChannelScopeGuard | Restricts /admin/channels, /admin/channels/:id, /admin/tenants, and /admin/tenants/:id to SuperAdmins and ChannelAdmins. Other roles are redirected to /dashboard. |
| DashboardGuard / TenantGuard | A ChannelAdmin with no tenant selected is redirected from the dashboard to /admin/channels. |
Route guards run on every navigation and cannot be bypassed by URL manipulation. Frontend gating controls only what is shown -- the backend independently re-checks scope on every API request (see below).
How Scope Is Enforced
ChannelAdmin scope is always resolved live from the database, never from the login token.
- A ChannelAdmin's reachable tenants are computed by joining the channels they administer (the
vsm_user_channeltable) to tenants (vsm_tenant.channel_id). An empty channel membership means they see nothing -- the system fails closed and never treats an empty set as "unrestricted". - The session token carries a
channelIdsclaim, but this is a login-time snapshot used for display only. Every authorization decision re-readsvsm_user_channel, so if a ChannelAdmin's channel membership is revoked, the change takes effect immediately rather than at the next token refresh. - The same applies from the other direction. When a SuperAdmin moves a tenant to another channel, the tenant leaves the old channel's administrators and joins the new one's on their next request — neither side needs to sign out and back in.
- A ChannelAdmin holds no tenant-scoped role. Its permissions are limited to two channel-level actions -- reading the channels it administers and managing the tenants within them -- plus the tenant-scoped operations it performs after selecting a tenant.
The channelIds value in a session token must never be used to grant access. It reflects channel membership at the moment of login and can be stale. All scope checks resolve channel membership from the database on each request.
Data Model
Three database structures back the channel layer:
| Object | Purpose |
|---|---|
channel | The channel (partner/reseller) itself -- name, slug, status. |
vsm_user_channel | Many-to-many mapping of ChannelAdmin users to channels. One admin can administer several channels. |
vsm_tenant.channel_id | The channel a tenant belongs to. Nullable: NULL marks a legacy "direct" tenant that only SuperAdmins can see. |
Channel API
Channel operations are served under /api/v1/channels:
| Endpoint | ChannelAdmin | Notes |
|---|---|---|
GET /channels | Yes | Returns only the channels they administer |
GET /channels/:id | Yes | Only if they administer it (otherwise 403) |
GET /channels/:id/tenants | Yes | Member channels only |
POST /channels | No | SuperAdmin only |
PUT /channels/:id | No | SuperAdmin only |
DELETE /channels/:id | No | SuperAdmin only |
POST /channels/:id/admins | No | SuperAdmin only -- assigns an existing ChannelAdmin to a channel |
See also Roles & Permissions for how ChannelAdmin fits into the overall RBAC model.