Built-in Authentication & Roles in Qödiak

Qödiak’s no‑code platform comes with a complete authentication system and role‑based access control right out of the box. From user registration to admin dashboards, every essential security feature is generated automatically, letting you focus on building functionality instead of wiring login flows.

What Qödiak Provides Automatically

When you create a new app, Qödiak adds the following pages and services without any manual configuration:

• User Registration page – includes bot protection and optional email verification.
• Login page – secure JWT‑based sign‑in with short‑lived tokens.
• Admin dashboard pages – pre‑populated with user management tools.
• Role‑based access control – ready to enforce permissions across your app.

Page Access Levels

Qödiak categorises every page into one of three access levels. Understanding these levels helps you decide which content should be public and which requires protection.

1. Public Pages

Anyone can view these pages – no login is required. Typical examples include a landing page, marketing blog, or help centre.

2. Authenticated Pages

These pages require a signed‑in user, regardless of role. Use them for features like a personal profile, order history, or a community forum.

3. Role‑Restricted Pages

Access is limited to users who hold a specific role. Common scenarios are admin panels, finance reports, or premium‑member sections.

Role‑Based Access Control (RBAC)

Qödiak’s RBAC system is built around the RoleGate component and a set of helper methods that you can attach to any page or UI element.

RoleGate Component

Wrap any block of content with <RoleGate requiredRoles="admin, manager">…</RoleGate> to ensure it only renders for users whose role list includes at least one of the specified roles.

Admin vs. Customer Separation

• Admin pages use .requireRole("admin") – only users with the admin role can access.
• Customer pages use .requireAuth – any authenticated user may view.

Custom Roles & Multiple Assignments

Beyond the default admin and customer roles, you can create any number of custom roles (e.g., editor, support). Users may hold multiple roles simultaneously, giving you fine‑grained control over complex permission scenarios.

Bot Protection Built In

To keep registration and login forms clean from automated abuse, Qödiak combines three layers of protection:

1. Honeypot fields – hidden inputs that bots typically fill; Qödiak discards any submission where these fields contain data.
2. CAPTCHA support – you can enable a visual or invisible CAPTCHA on the registration page with a single toggle.
3. Behavior analysis – Qödiak monitors interaction patterns (mouse movement, typing speed) to flag non‑human activity.

User Management Features

The admin dashboard gives you a full suite of tools to handle users across a multi‑tenant environment.

Invitation System

Send an email invitation that contains a secure, one‑time link. Recipients can complete registration without exposing a public sign‑up form.

Email Verification & Consent Tracking

When enabled, new accounts must confirm their email address. Qödiak also records consent to terms of service and stores an immutable audit log for compliance.

Multi‑Tenant Isolation

Each Qödiak app lives in its own tenant. User tables, authentication tokens, and data are isolated at the database level, ensuring that a user from App A can never see data from App B.

Security Foundations

Qödiak follows industry‑standard practices to keep credentials and data safe.

• JWT‑based authentication – tokens expire after 24 hours, forcing periodic re‑authentication.
• Password hashing – uses ASP.NET Identity with bcrypt (or SHA‑256 fallback) to store passwords securely.
• Row‑Level Security (RLS) – enforces tenant data isolation directly in the database, preventing accidental cross‑tenant reads.
• Rate limiting – authentication endpoints are throttled to mitigate credential‑stuffing attacks.

How It Works for App Builders

From the moment you click “Create App,” Qödiak handles the heavy lifting.

1. The AI engine generates polished Login, Register, and Admin pages, complete with responsive design.
2. The self‑registration toggle lets you decide whether anyone can sign up or if you prefer an invitation‑only model.
3. All authentication routes are pre‑wired to the JWT service; you don’t need to write any backend code.
4. Admins can manage users, assign roles, and view audit logs directly from the dashboard.

Step‑by‑Step: Configuring Access for a New Page

Below is a practical guide to protect a newly created “Reports” page so that only users with the analyst role can view it.

1. Create the page using Qödiak’s page builder. Name it Reports.
2. Add a RoleGate wrapper around the entire page content:

   <RoleGate requiredRoles="analyst">
       …your report components…
   </RoleGate>

3. Define the custom role in the admin dashboard:
   • Navigate to Users → Roles → Add New Role.
   • Enter “analyst” and save.
4. Assign the role to users who need access:
   • Open a user profile, click Roles, check “analyst,” and confirm.
5. Test the restriction by logging in as a user without the role – the page should display a “Access Denied” message automatically.
6. Publish the changes. The page is now securely limited to analysts only.

Real‑World Use Cases

Admin Control Panel

All internal tools (user management, system settings, logs) are placed behind pages that call .requireRole("admin"). This guarantees that only staff members with the admin role can modify critical data.

Customer Self‑Service Portal

Features like order tracking, subscription management, and support tickets are marked as Authenticated Pages using .requireAuth. Any logged‑in customer can access them, regardless of additional roles.

Premium Content Library

For SaaS products that sell tiered subscriptions, create a custom role called premium. Wrap premium articles with <RoleGate requiredRoles="premium"> so only paying members see the content.

Tips & Best Practices

Tip: Keep the self‑registration toggle disabled for production apps that require strict onboarding. Use the invitation system to control who can join, then assign roles manually.

Security note: Regularly review the audit logs for unusual login patterns. Combined with Qödiak’s behavior analysis, you can quickly spot and block compromised accounts.

Performance tip: Because JWT tokens expire after 24 hours, consider implementing a silent refresh mechanism on the client side to keep active users logged in without forcing them to re‑enter credentials.

Conclusion

Qödiak’s built‑in authentication and role system gives you a robust, production‑ready security foundation without writing a single line of code. By leveraging public, authenticated, and role‑restricted page types, the RoleGate component, and comprehensive user‑management tools, you can build anything from a simple public brochure site to a multi‑tenant enterprise portal—all while maintaining best‑in‑class security practices.