Field Users
The Field Users tab of a project lists the people who work on it in the field. Opening a person
shows their details (the one read: GET /v1/orgs/{orgId}/field-users/{userId}/debug) and lets an
admin edit, verify, mark them a crew lead, remove them, or run a recovery action.
Who can
| Action | Permission | Default roles |
|---|---|---|
| Open a field user, edit, verify, crew lead, remove, add | fieldusers.manage | Master Admin, Org Manager, Project Admin, Engineer |
| Force logout, reset password, fix email | fieldusers.manage | Master Admin, Org Manager, Project Admin, Engineer |
| Anonymise & delete (held company-wide only) | fieldusers.power | Master Admin, Org Manager, Project Admin, Engineer |
Supervisors and Senior Supervisors cannot manage field users. Each org can change these in Org › Users and Roles › Role Matrix.
A role on one project counts on that project (BUG-0041)
Permissions are decided in the project, so a role given to someone on one project counts there (owner ruling 2026-10-14):
- Project routes (
/projects/{projectId}/field-users/…: edit, verify, unverify, crew lead, remove, add): decided in the URL project. - The details read, the recovery actions and the company-wide list (
/field-users/…, no project in the URL, because a worker spans projects): allowed when the permission is held company-wide or on at least one of the caller’s projects. The details, the actions and the list are narrowed to the projects where it is held. A worker on none of them answers not found.
Example: Sam Carter is a Supervisor company-wide and Project Admin on Harbour Road. Sam opens and edits a field user on Harbour Road; their details show only what is on the projects where Sam may manage field users.
Changing a field user’s role on a project is judged by the admin’s authority on that project.
Code
- Gates:
backend/api/internal/fielduser/handler.go(keyReach),power_actions.go(powerActionGate). - Rule:
authz.AccessibleProjectIDsWithKey(backend/pkg/authz/accessible_projects.go). - Web: the power actions read the project’s permissions (
usePowerActionCaps(projectId)). - Tests:
backend/api/internal/fielduser/bug0041_project_roles_test.go.