Permissions

Roles and what they can do.

Auvyra checks every permission on the server. Hiding a button is never the only protection.

Permission	Owner	Administrator	Editor	Writer	Presenter	Viewer
View the dashboard	Yes	Yes	Yes	Yes	Yes	Yes
View the station, schedule, presenters, analytics and team	Yes	Yes	Yes	No	Yes	Yes
Write drafts of news and articles, and upload images	Yes	Yes	Yes	Yes	No	No
Edit anyone's content	Yes	Yes	Yes	No	No	No
Publish content	Yes	Yes	Yes	No	No	No
Create and edit custom pages	Yes	Yes	Yes	No	No	No
Manage schedule and presenters	Yes	Yes	No	No	No	No
Review applications	Yes	Yes	No	No	No	No
Control AutoDJ, playlists and requests	Yes	Yes	No	No	No	No
Read contact messages	Yes	Yes	No	No	No	No
Use the Studio, moderate shoutouts and comments	Yes	Yes	Yes	No	Yes	No
Presenter dashboard	Yes	Yes	No	No	Yes	No
Manage polls, competitions, events and subscribers	Yes	Yes	Yes	No	No	No
Send newsletters and manage listener accounts	Yes	Yes	Yes	No	No	No
Site Builder and navigation	Yes	Yes	No	No	No	No
Station settings and integrations	Yes	Yes	No	No	No	No
Manage users	Yes	Yes	No	No	No	No
System settings	Yes	No	No	No	No	No

Writers only have news and articles. They can edit and delete their own drafts, and an editor or above publishes them. Once something is published, only an editor or above can change it.

Presenters get a dashboard of their own. See Presenters.

Everyone only sees what they can use. The menu, search and shortcuts leave out anything your role cannot open, and each page checks again on the server, so typing an address does not get around it.

Drafts and scheduled posts stay private to their author and to editors and above. Writers see published items and their own drafts, and everyone else below editor only sees what is published. Recent activity is for owners and administrators, and the schedule and presenter lists leave out anything hidden for anyone who cannot manage them.

Accounts

Nobody can sign up for your team. The setup wizard creates the owner, and owners and administrators add everyone else under User Management. Listener accounts are separate, and never reach the dashboard.

Sessions

Passwords are hashed with Argon2id
A session ends after 7 days of inactivity, and after 30 days regardless
Session tokens are stored only as hashes, so a database leak does not expose them
Disabling an account takes effect on its next request, as do role changes
Login attempts are rate limited