ConfigAccessorPlugin
Display configuration values, roles, permissions, and system settings on any page. See Plugins for a complete list of available plugins.
Syntax
[{ConfigAccessor key='ngdpbase.server.port'}]
[{ConfigAccessor type='roles'}]
You must supply either key or type.
Parameters
| Parameter | Type | Default | Description |
|---|---|---|---|
key | string | *(required or type)* | Dot-notation config key. Supports * wildcards. |
type | string | *(required or key)* | Named display type — see [Types](#types) below. |
valueonly | boolean | false | Return plain text instead of a formatted card. |
before | string | (none) | Prefix before each value (use with valueonly). |
after | string | '' / \n | Suffix after each value. Default: '' for single keys, \n for wildcards. |
caption | string | (none) | Descriptive text shown below a single key value. |
table | boolean | false | Force a single key result into table format. |
noheader | boolean | false | Suppress the card header on wildcard and single-key results. |
pageSize | number | 0 | Rows per page for wildcard results. 0 shows all rows (no pagination). |
page | number | 1 | Page number when using pageSize. Also reads from the ?page= query string. |
manager | string | (none) | Manager name — required when type='manager'. |
feature | string | (none) | Feature name — required when type='feature'. |
enabled | boolean | (none) | Filter keywords or categories by enabled state. |
category | string | (none) | Filter by category (use with userKeywords, systemKeywords). |
storageLocation | string | (none) | regular or required — filter system categories. |
Key Examples
Single config value
[{ConfigAccessor key='ngdpbase.server.port'}] renders as:
Current Configuration Value
Key: ngdpbase.server.port
Value: 3000
Single value with caption
[{ConfigAccessor key='ngdpbase.server.port' caption='Port the server binds to'}] renders as:
Current Configuration Value
Key: ngdpbase.server.port
Value: 3000
Port the server binds to
Single value forced into table format
[{ConfigAccessor key='ngdpbase.server.port' table='true'}] renders as:
| Key | Value |
|---|---|
ngdpbase.server.port |
3000 |
Single value without header
[{ConfigAccessor key='ngdpbase.server.port' noheader='true'}] renders as:
Key: ngdpbase.server.port
Value: 3000
Inline value in text
Running [{ConfigAccessor key='ngdpbase.application-name' valueonly='true'}] version [{ConfigAccessor key='ngdpbase.version' valueonly='true'}].
Running GeoHazardWatch version 5.34.0.
Wildcard — all server keys
[{ConfigAccessor key='ngdpbase.server.*'}] renders as:
Configuration Values (7 matches) —
ngdpbase.server.*
| Key | Value |
|---|---|
ngdpbase.server.behind-cloudflare |
false |
ngdpbase.server.geolite2-city-file |
|
ngdpbase.server.host |
0.0.0.0 |
ngdpbase.server.port |
3000 |
ngdpbase.server.tls.cert-file |
|
ngdpbase.server.tls.key-file |
|
ngdpbase.server.trust-proxy |
false |
Wildcard without header
[{ConfigAccessor key='ngdpbase.server.*' noheader='true'}] renders as:
| Key | Value |
|---|---|
ngdpbase.server.behind-cloudflare |
false |
ngdpbase.server.geolite2-city-file |
|
ngdpbase.server.host |
0.0.0.0 |
ngdpbase.server.port |
3000 |
ngdpbase.server.tls.cert-file |
|
ngdpbase.server.tls.key-file |
|
ngdpbase.server.trust-proxy |
false |
Wildcard with pagination
Use pageSize to break large wildcard results into pages. Prev/Next links appear automatically when there is more than one page.
[{ConfigAccessor key='ngdpbase.*' pageSize='10'}] renders as:
Configuration Values (627 matches) —
ngdpbase.*
| Key | Value |
|---|---|
ngdpbase.page.provider.filesystem.private.files.storemeta |
store.json |
ngdpbase.page.provider.filesystem.private.files.userindex |
user-index.json |
ngdpbase.page.provider.filesystem.private.files.userkeys |
user-keys.json |
ngdpbase.page.provider.filesystem.requiredpagesdir |
./required-pages |
ngdpbase.page.provider.filesystem.storagedir |
${SLOW_STORAGE}/pages |
ngdpbase.page.provider.filesystem.versionsdir |
versions |
ngdpbase.page.provider.versioning.indexfile |
${FAST_STORAGE}/page-index.json |
ngdpbase.permissions.definitions |
{
"page-read": {
"description": "View pages",
"label": "View pages",
"icon": "eye",
"color": "#6c757d",
"audit": {
"on-failure": "continue",
"enabled": false,
"description": "Page read; off by default so a general-purpose deployment does not drown its log in reads. On, a records-style deployment gets who looked at what (#1129)"
}
},
"page-edit": {
"description": "Edit pages",
"label": "Edit pages",
"icon": "edit",
"color": "#007bff",
"audit": {
"on-failure": "continue",
"description": "Page edited"
}
},
"page-public": {
"description": "Make a page public: move it out of its vault (checked by the page's system-category, #1504)",
"label": "Make a page public by moving it out of its vault",
"icon": "globe",
"color": "#20c997"
},
"page-create": {
"description": "Create new pages",
"label": "Create pages",
"icon": "plus",
"color": "#28a745",
"audit": {
"on-failure": "continue",
"description": "Page created"
}
},
"page-delete": {
"description": "Delete pages",
"label": "Delete pages",
"icon": "trash",
"color": "#dc3545",
"audit": {
"on-failure": "refuse",
"description": "Page deleted; destruction, so the record must outlive the page"
}
},
"page-rename": {
"description": "Rename pages",
"label": "Rename pages",
"icon": "i-cursor",
"color": "#fd7e14",
"audit": {
"on-failure": "continue",
"description": "Page renamed"
}
},
"page-export": {
"description": "Export pages",
"label": "Export pages",
"icon": "file-export",
"color": "#6c757d",
"audit": {
"on-failure": "continue",
"description": "Page exported to a file; bulk extraction of content, gated on read until a bulk surface exists"
}
},
"asset-read": {
"description": "View assets (attachments)",
"label": "View attachments",
"icon": "paperclip",
"color": "#6c757d",
"audit": {
"on-failure": "continue",
"enabled": false,
"description": "Attachment read; not recorded, read volume"
}
},
"media-read": {
"description": "Browse and view the media library (not delegated to anonymous visitors)",
"label": "Browse and view the media library",
"icon": "images",
"color": "#6c757d"
},
"asset-upload": {
"description": "Upload assets",
"label": "Upload attachments",
"icon": "upload",
"color": "#28a745",
"audit": {
"on-failure": "continue",
"description": "File uploaded"
}
},
"asset-delete": {
"description": "Delete assets",
"label": "Delete attachments",
"icon": "trash",
"color": "#dc3545",
"audit": {
"on-failure": "refuse",
"description": "File deleted; destruction"
}
},
"share-create": {
"description": "Create share links — hand out anonymous read access to content you may read — and see your own (#1224, #1638)",
"label": "Create share links and see your own",
"icon": "share-alt",
"color": "#20c997",
"audit": {
"on-failure": "refuse",
"description": "Share link created; mints an anonymous-access credential, the same shape as token-mint"
}
},
"share-extend": {
"description": "Extend your own share links (#1638)",
"label": "Extend your own share links",
"icon": "clock",
"color": "#20c997",
"audit": {
"on-failure": "refuse",
"description": "Share link's lifetime extended by its issuer, by up to 24 hours (#1388)"
}
},
"share-revoke": {
"description": "Revoke your own share links; revoking anyone's also needs admin-system (#1638)",
"label": "Revoke your own share links",
"icon": "ban",
"color": "#20c997",
"audit": {
"on-failure": "refuse",
"description": "Share link revoked; pairs with token-revoke"
}
},
"profile-manage": {
"description": "Manage your own account — profile, preferences, display theme, pinned pages and the /my/* pages (#1198). Every signed-in role; never anonymous",
"label": "Manage your own profile and preferences",
"icon": "user-cog",
"color": "#6f42c1"
},
"account-security": {
"description": "Change what protects your own account — password, email, sign-in methods (passkeys), vault takeout and import, approving a device (#1525). Granted wherever profile-manage is; asks for a fresh sign-in when listed in ngdpbase.auth.step-up",
"label": "Change your password, email and sign-in methods, and approve devices",
"icon": "user-shield",
"color": "#6f42c1",
"step-up": true
},
"config-manage": {
"description": "Change any configuration setting, and download a backup (#1525). Admin only by default; asks for a fresh sign-in when listed in ngdpbase.auth.step-up",
"label": "Change site settings and download backups",
"icon": "sliders-h",
"color": "#dc3545",
"step-up": true
},
"secret-reveal": {
"description": "Unmask a configuration secret (#1525). Admin only by default; asks for a fresh sign-in when listed in ngdpbase.auth.step-up. Hashed credentials (agent tokens) and shown-once secrets can never be revealed",
"label": "Show hidden configuration secrets",
"icon": "eye-slash",
"color": "#dc3545",
"audit": {
"on-failure": "continue",
"description": "A masked configuration value shown to an administrator; the key is recorded, never the value"
},
"step-up": true
},
"comment-create": {
"description": "Add a comment, and delete your own; deleting anyone's is admin-system (#1198)",
"label": "Add comments and delete your own",
"icon": "comment",
"color": "#0dcaf0",
"audit": {
"on-failure": "continue",
"description": "Comment added to a page — user content written on someone's behalf, the page-edit class (#1232)"
}
},
"token-mint": {
"description": "Mint, list and revoke your own agent tokens — a standing credential carrying a slice of your authority (#1198, #1178). Every signed-in role except demo-admin; never anonymous (#1734). A token can never carry this scope",
"label": "Make and revoke your own agent tokens",
"icon": "key",
"color": "#fd7e14",
"audit": {
"on-failure": "refuse",
"description": "Agent token minted; a credential nobody knows exists is the worst case"
},
"step-up": true
},
"token-extend": {
"description": "Extend your own live agent tokens instead of minting new ones, to at most max-ttl-hours from now; the token and its scopes stay the same (#1734). Admin only by default. A token can never carry this scope",
"label": "Extend your own agent tokens",
"icon": "clock",
"color": "#fd7e14",
"audit": {
"on-failure": "refuse",
"description": "Agent token's expiry moved later by its owner; carries the old and new expiry (#1734)"
},
"step-up": true
},
"proxy-grant": {
"description": "Let another person act for you, within permissions you hold, and revoke it (#1762). Every signed-in role except demo-admin; an administrator making or revoking a grant for someone else also needs user-edit, and that grant never carries a copy of the person's vault key. A grant that includes proxy-grant lets the proxy give others access too. Asks for a fresh sign-in",
"label": "Let someone act for you, and stop them",
"icon": "user-friends",
"color": "#fd7e14",
"audit": {
"on-failure": "refuse",
"description": "Proxy grant made: someone may act for the user named in user; actor is who made it (#1762)"
},
"step-up": true
},
"vault-proxy": {
"description": "Let a person acting for you into your vaults (#1762). Read only from a proxy grant: a grant that includes it lets the proxy act inside your vaults within the grant's other permissions; without it a proxy never reaches them. Encrypted vaults stay shut to a proxy until a vault key copy is supported (#1762 slice 5). Every signed-in role except demo-admin, beside proxy-grant. Never carried by an agent token or an app",
"label": "Let someone acting for you into your vaults",
"icon": "lock-open",
"color": "#fd7e14",
"audit": {
"on-failure": "continue",
"enabled": false,
"description": "Not an action: read from a proxy grant at the vault door; the grant itself is recorded as proxy-grant"
}
},
"store-create": {
"description": "Walk through a private store's door and create your own copy of it — with a user key and recovery words when the store kind is encrypted (#1414). Every signed-in role; never anonymous. The door also needs a password sign-in, so a token or share cannot use it",
"label": "Create your own private store",
"icon": "lock",
"color": "#198754",
"audit": {
"on-failure": "refuse",
"description": "A user's private store copy created at its door (#1414) — with key material when sealed; never the words or a key in the record"
}
},
"asset-edit": {
"description": "Edit asset metadata (EXIF/IPTC/XMP)",
"label": "Edit attachment details such as photo information",
"icon": "pen",
"color": "#fd7e14",
"audit": {
"on-failure": "continue",
"description": "Attachment metadata edited; EXIF/IPTC and catalog fields change provenance"
}
},
"search-page": {
"description": "Search pages",
"label": "Search pages",
"icon": "search",
"color": "#6c757d",
"audit": {
"on-failure": "continue",
"enabled": false,
"description": "Page search; not recorded, read volume"
}
},
"search-user": {
"description": "Search users",
"label": "Search for people",
"icon": "search",
"color": "#6c757d",
"audit": {
"on-failure": "continue",
"enabled": false,
"description": "Users searched for; enumerating users is disclosive in a way searching pages is not. Off by default as read volume"
}
},
"user-read": {
"description": "View user list and profiles",
"label": "View the list of people and their profiles",
"icon": "users",
"color": "#6c757d",
"audit": {
"on-failure": "continue",
"enabled": false,
"description": "User profile read; not recorded, read volume"
}
},
"user-edit": {
"description": "Edit user accounts",
"label": "Edit people's accounts",
"icon": "user-edit",
"color": "#007bff",
"audit": {
"on-failure": "continue",
"description": "Account changed in a way that alters what it may do or who holds it: roles, password, active, external, email, profile lock. Preference edits are not recorded"
}
},
"user-create": {
"description": "Create user accounts",
"label": "Create accounts",
"icon": "user-plus",
"color": "#28a745",
"audit": {
"on-failure": "continue",
"description": "Account created; by an administrator, by self-registration, or provisioned by an identity provider"
}
},
"user-delete": {
"description": "Delete user accounts",
"label": "Delete accounts",
"icon": "user-minus",
"color": "#dc3545",
"audit": {
"on-failure": "refuse",
"description": "Account deleted; destruction of an identity and its attribution, recorded before the delete"
}
},
"identity-read": {
"description": "List, search and view identity records, of users and contacts alike, and organizations, and their affiliations, through IdentityManager and OrganizationManager, and the /admin/contacts and /admin/organizations views (#1930). Was contact-read until #2038; a policy naming that is still read as this for one release. Admins and demo admins by default; an add-on grants it to its own roles in its own policy",
"label": "Find and view identity records (users, contacts and organizations)",
"icon": "address-book",
"color": "#6c757d"
},
"identity-manage": {
"description": "Create, edit, delete and link identity records, of users and contacts alike, and organizations, and an identity's affiliations, through IdentityManager and OrganizationManager (#1930). Reading them is identity-read. Was contact-manage until #2038; a policy naming that is still read as this for one release. Admins by default; an add-on grants it to its own roles in its own policy",
"label": "Add, change and link identity records (users, contacts and organizations)",
"icon": "address-book",
"color": "#0d6efd",
"audit": {
"on-failure": "continue",
"description": "Identity record or organization created, changed, deleted or linked to an account (recorded as contact-manage before #2038); metadata names the kind (person or organization), the operation and the fields changed, never their values"
}
},
"admin-read": {
"description": "View administration screens (read-only, no changes)",
"label": "View administration screens without changing anything",
"icon": "eye",
"color": "#6c757d",
"audit": {
"on-failure": "continue",
"enabled": false,
"description": "Admin dashboard read; not recorded, read volume"
}
},
"admin-system": {
"description": "System administration",
"label": "Administer the site",
"icon": "cog",
"color": "#dc3545"
},
"admin-roles": {
"description": "Role management",
"label": "Manage roles",
"icon": "shield-alt",
"color": "#dc3545"
},
"comment-delete": {
"description": "Comment marked deleted; who removed it and whose it was (#1232)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"vault-repair": {
"description": "A vault page's leftovers moved into its vault (#1842): its shared-pool files (moved, or copied where other public pages use them) and its footnotes and comments from the public folders. Names the owner, vault and page uuid and the counts, never a title or file name. Run by the vault's owner, or for a vault that isn't sealed by someone holding admin-system",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"footnote-edit": {
"description": "A page's footnote list changed — action add, import, transfer, update or delete; page content written on someone's behalf (#1233)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"page-link-rewrite": {
"description": "Inbound links rewritten after a rename",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"token-revoke": {
"description": "Agent token revoked",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"proxy-revoke": {
"description": "Proxy grant ended: revoked, or the account closed; user is the user represented, actor who ended it (#1762)",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"consent-grant": {
"description": "A user accepted a document they are asked to accept (#1603): which document (core's terms-of-service or privacy-policy, or an add-on's), its version and effective date, and how (sign-up, sign-in, turning an add-on on). Recorded before the acceptance is stored, which cannot proceed without it: consent must be provable",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"consent-withdraw": {
"description": "A user's acceptances ended (#1603): today only when their account is deleted, which removes their consent records; names the documents and versions they had accepted. Recorded before the records are removed",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"proxy-switch": {
"description": "A signed-in session started or stopped acting for someone under a proxy grant, or opens their private store: chosen, switched-back, ended because the grant no longer allows it (grant-ended, proxy-access-off), or vault-opened; user is the user represented, actor the user signed in (#1762)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"authentication-success": {
"description": "Sign-in succeeded",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"authentication-failed": {
"description": "Sign-in failed",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"authentication-logout": {
"description": "User signed out",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"authorization-deny": {
"description": "Access denied",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"authorization-allow": {
"description": "Access granted; emitter exists, nothing in production calls it",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"policy-evaluate": {
"description": "Security policy evaluated; emitter exists, nothing in production calls it",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"security-event": {
"description": "Security violation detected; the kind is in metadata.securityEventType",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"share-access": {
"description": "Share link used; batched counts for keyword links, one record per page or file opened through a vault link (#1388)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"system-start": {
"description": "Instance started; reports whether the previous run ended cleanly",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"system-shutdown": {
"description": "Instance shut down cleanly; its absence before the next start is the signal",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"config-change": {
"description": "Configuration changed by an administrator; standard so a broken audit configuration can still be repaired from the UI",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"manager-state-change": {
"description": "A manager changed state: degraded, disabled, failed or recovered",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"posture-recorded": {
"description": "Security posture at startup, compared against the previous start",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"job-started": {
"description": "A background job started, and who asked for it",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"review-filed": {
"description": "A request was filed for review (#2072): who filed it, its id, kind, the add-on handler and the permission whose holders decide; never its summary or details",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"review-approved": {
"description": "A request was approved and the add-on's handler carried it out (#2072): who decided, its id, kind and handler; never the note, summary or details",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"review-rejected": {
"description": "A request was rejected (#2072): who decided, its id, kind and handler; never the note, summary or details",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"review-failed": {
"description": "A request was approved but the add-on's handler did not carry it out, so it stays open (#2072): who approved it, its id, kind and handler",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"job-completed": {
"description": "A background job finished successfully",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"job-failed": {
"description": "A background job failed",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"job-skipped": {
"description": "Scheduled slots a job passed over, by its catch-up or overlap rule",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"job-interrupted": {
"description": "A scheduled run stopped by shutdown and handed to the next start, which resumes it",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"job-retry": {
"description": "An administrator retried a scheduled run now instead of at its retry time",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"job-schedule-change": {
"description": "A scheduled job's rule changed; its slots are counted again from then",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"page-raw-edit": {
"description": "Edit a page's raw file in the admin raw editor — bypasses the page editor's checks (#1638)",
"label": "Edit a page's raw file, skipping the page editor's checks",
"icon": "file-code",
"color": "#dc3545",
"audit": {
"on-failure": "continue",
"description": "Page edited through the admin raw editor"
}
},
"session-revoke": {
"description": "End another person's signed-in session (#1638)",
"label": "Sign other people out",
"icon": "user-slash",
"color": "#dc3545",
"audit": {
"on-failure": "continue",
"description": "Session revoked by an administrator"
}
},
"session-clear-anonymous": {
"description": "Anonymous sessions cleared",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"store-takeout": {
"description": "A whole private store downloaded by its owner, DECRYPTED; who took it, which store, and how much left",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"store-import": {
"description": "A takeout imported into its owner's private store; a bulk write — who, which store, pages and files written or skipped",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"config-reset": {
"description": "Every custom configuration value discarded; recorded before the reset, which cannot proceed without it",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"backup-create": {
"description": "A full backup written; where it went and who asked",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"backup-restore": {
"description": "A restore of a backup's databases started from Admin → Backup: which backup and who asked; recorded before the fresh backup and the staging, which cannot proceed without it (#1723)",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"backup-restore-replace": {
"description": "A staged database restore replaced by another before the restart applied it: which backup replaced which, and who asked; recorded first, which cannot proceed without it (#1723)",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"backup-restore-cancel": {
"description": "A staged database restore cancelled before the restart applied it: which backup, who staged it and who cancelled; recorded first, which cannot proceed without it (#1723)",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"backup-restore-applied": {
"description": "A staged restore (site or databases-only) put in place at start: which backup, when it was taken, who started the restore and which parts were applied; written into the restored audit log, so the log itself says a restore happened (#1876)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"addon-install": {
"description": "An add-on named in ngdpbase.addons.install installed into the data folder: package, version, sha512 and the repository its provenance names; recorded before it is written, which cannot proceed without it (#1830)",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"addon-update": {
"description": "An installed add-on moved to another version by an administrator's Update: who, and from which version to which (#1830; the Update action is not built yet)",
"grantable": false,
"audit": {
"on-failure": "refuse",
"enabled": false
}
},
"addon-verify-failed": {
"description": "An add-on refused or set aside by a check: its sha512, provenance, tarball contents, package.json, the lock file, or a changed installed folder (#1830)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"audit-export": {
"description": "Export the audit trail to a file (#1638)",
"label": "Export the audit trail",
"icon": "file-export",
"color": "#dc3545",
"audit": {
"on-failure": "continue",
"description": "The audit trail exported to a file; who took a copy, in what format, with what filter"
}
},
"audit-chain-restart": {
"description": "Hash chain restarted, with the reason; the marker is the action and cannot half-complete",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"oidcauthorize-allow": {
"description": "OpenID Connect: an app's sign-in request was allowed and a code issued (#1575)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"oidcauthorize-deny": {
"description": "OpenID Connect: an app's sign-in request was refused (denied consent, sign-in required, bad request)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"oidctoken-issue": {
"description": "OpenID Connect: tokens issued to an app, with the grant type that earned them",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"oidctoken-error": {
"description": "OpenID Connect: the token endpoint refused an app's request",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"oidctoken-reuse": {
"description": "OpenID Connect: a used code or refresh token was presented again; its grant was revoked (possible replay)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"oidctoken-revoke": {
"description": "OpenID Connect: an access or refresh token was destroyed",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"oidcgrant-revoke": {
"description": "OpenID Connect: an app's grant and every token under it were revoked",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"oidcuserinfo-error": {
"description": "OpenID Connect: UserInfo refused a request (bad, expired or revoked token, unknown account)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"oidcserver-error": {
"description": "OpenID Connect: the provider failed while handling a request",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"reauth-prompt": {
"description": "Step-up: an action asked for a fresh sign-in (#1525) — or refused a delegated credential that cannot give one",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"reauth-success": {
"description": "Step-up: the user re-authenticated, with the factor used",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"reauth-failure": {
"description": "Step-up: a re-authentication failed (wrong password, another user's passkey, throttled)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"signinapproval-request": {
"description": "Sign-in approval: an approval message was sent for a waiting sign-in, saying from where (IP, approximate place, browser) (#1532)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"signinapproval-open": {
"description": "Sign-in approval: the approval page was opened, with the opener's IP and browser; opening changes nothing (#1532)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"signinapproval-approve": {
"description": "Sign-in approval: the user pressed Approve (#1532)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"signinapproval-deny": {
"description": "Sign-in approval: the user pressed Deny; that sign-in will not complete (#1532)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"signinapproval-expire": {
"description": "Sign-in approval: a waiting sign-in expired before it was completed (#1532)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"emailchange-request": {
"description": "A user asked to change their own email: a confirmation link was sent to the new address (#2073). Names only, never an address",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"emailchange-confirm": {
"description": "A user's new email was confirmed by its emailed link and saved (#2073). Names only, never an address",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"signinapproval-sendfail": {
"description": "Sign-in approval: the approval message could not be sent (transport error, or no channel configured) (#1532)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"signinapproval-abandon": {
"description": "Sign-in approval: the browser that was waiting gave up the sign-in (#1532)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"signinapproval-throttle": {
"description": "Sign-in approval: another approval message was asked for too soon and not sent (#1532)",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"invitation-send": {
"description": "Invitation sent (#2049): a one-time link emailed to a new user to set up their sign-in; user is who sent it, resource the account invited. A credential nobody knows exists is the worst case, so it is recorded before the link exists",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"invitation-use": {
"description": "Invitation used (#2049): the invited user opened their link and was signed in once; the link is spent",
"grantable": false,
"audit": {
"on-failure": "continue"
}
},
"invitation-cancel": {
"description": "Invitation cancelled (#2049): an administrator cancelled it or sent a new one, the email could not be sent, or the account was deleted; the link stops working",
"grantable": false,
"audit": {
"on-failure": "refuse"
}
},
"invitation-expire": {
"description": "Invitation expired (#2049): the link was not used in time and was removed",
"grantable": false,
"audit": {
"on-failure": "continue"
}
}
} |
ngdpbase.plugin.searchresult.maxItems |
50 |
ngdpbase.plugin.searchresult.showScore |
true |
Types
The type parameter selects a named display mode. Valid values:
| Type | Description |
|---|---|
roles | All configured roles with display name, description, and type |
permissions | Role × permission matrix showing which roles have which permissions |
policy-summary | Alias for permissions |
permissionsList | All permissions grouped by target with name, icon, and description |
actions | All unique actions defined in ACL policies |
policies | ACL policies sorted by priority |
authMethods | Authentication providers (sensitive fields masked for non-admins) |
features | Feature flags grouped by feature name |
user-summary | Current user's login status, roles, and permissions |
userKeywords | User-defined keywords for content tagging |
systemKeywords | System-defined controlled vocabulary keywords |
systemCategories | System categories that determine page storage location |
manager | Configuration for a named manager (requires manager=) |
feature | Configuration for a named feature (requires feature=) |
Type Examples
Roles
[{ConfigAccessor type='roles'}] renders as:
Available Roles
System and user-defined roles| Role Name | Display Name | Description | Type | Icon |
|---|---|---|---|---|
admin |
Administrator | Full system access to all features | System | |
anonymous |
Anonymous | Public access without authentication | System | |
contributor |
Contributor | Can create and edit pages | System | |
editor |
Editor | Can create, edit, delete, and rename pages | System | |
reader |
Reader | Read-only access to content | System | |
user-admin |
User Administrator | Can manage users — create, edit, deactivate, delete | System | |
vault-owner |
Vault Owner | Everything inside your own vaults — pages and files: read, create, edit, rename, delete, upload, share by link. Applies only in vaults you own; not deleting a vault. Given to every account (#1539) | System | |
demo-admin |
Demo Administrator | Read-only access to the admin dashboard. For public demo instances: can view every admin screen but change nothing, and cannot see the user list. | Custom |
Permissions matrix (role × permission)
[{ConfigAccessor type='permissions'}] renders as:
Security Policy Summary
Permissions matrix showing which roles have which permissions, derived from the access policies| Permission | Administrator | User Administrator | Editor | Contributor | Demo Administrator | Vault Owner | Reader | Anonymous |
|---|---|---|---|---|---|---|---|---|
page-read
View pages |
||||||||
page-edit
Edit pages |
||||||||
page-public
Make a page public by moving it out of its vault |
||||||||
page-create
Create pages |
||||||||
page-delete
Delete pages |
||||||||
page-rename
Rename pages |
||||||||
page-export
Export pages |
||||||||
asset-read
View attachments |
||||||||
media-read
Browse and view the media library |
||||||||
asset-upload
Upload attachments |
||||||||
asset-delete
Delete attachments |
||||||||
share-create
Create share links and see your own |
||||||||
share-extend
Extend your own share links |
||||||||
share-revoke
Revoke your own share links |
||||||||
profile-manage
Manage your own profile and preferences |
||||||||
account-security
Change your password, email and sign-in methods, and approve devices |
||||||||
config-manage
Change site settings and download backups |
||||||||
secret-reveal
Show hidden configuration secrets |
||||||||
comment-create
Add comments and delete your own |
||||||||
token-mint
Make and revoke your own agent tokens |
||||||||
token-extend
Extend your own agent tokens |
||||||||
proxy-grant
Let someone act for you, and stop them |
||||||||
vault-proxy
Let someone acting for you into your vaults |
||||||||
store-create
Create your own private store |
||||||||
asset-edit
Edit attachment details such as photo information |
||||||||
search-page
Search pages |
||||||||
search-user
Search for people |
||||||||
user-read
View the list of people and their profiles |
||||||||
user-edit
Edit people's accounts |
||||||||
user-create
Create accounts |
||||||||
user-delete
Delete accounts |
||||||||
identity-read
Find and view identity records (users, contacts and organizations) |
||||||||
identity-manage
Add, change and link identity records (users, contacts and organizations) |
||||||||
admin-read
View administration screens without changing anything |
||||||||
admin-system
Administer the site |
||||||||
admin-roles
Manage roles |
||||||||
page-raw-edit
Edit a page's raw file, skipping the page editor's checks |
||||||||
session-revoke
Sign other people out |
||||||||
audit-export
Export the audit trail |
Permissions list (all permissions with descriptions)
[{ConfigAccessor type='permissionsList'}] renders as:
Account Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
account-security |
Change your password, email and sign-in methods, and approve devices |
Admin Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
admin-read |
View administration screens without changing anything | |
admin-system |
Administer the site | |
admin-roles |
Manage roles |
Asset Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
asset-read |
View attachments | |
asset-upload |
Upload attachments | |
asset-delete |
Delete attachments | |
asset-edit |
Edit attachment details such as photo information |
Audit Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
audit-export |
Export the audit trail |
Comment Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
comment-create |
Add comments and delete your own |
Config Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
config-manage |
Change site settings and download backups |
Identity Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
identity-read |
Find and view identity records (users, contacts and organizations) | |
identity-manage |
Add, change and link identity records (users, contacts and organizations) |
Media Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
media-read |
Browse and view the media library |
Page Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
page-read |
View pages | |
page-edit |
Edit pages | |
page-public |
Make a page public by moving it out of its vault | |
page-create |
Create pages | |
page-delete |
Delete pages | |
page-rename |
Rename pages | |
page-export |
Export pages | |
page-raw-edit |
Edit a page's raw file, skipping the page editor's checks |
Profile Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
profile-manage |
Manage your own profile and preferences |
Proxy Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
proxy-grant |
Let someone act for you, and stop them |
Search Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
search-page |
Search pages | |
search-user |
Search for people |
Secret Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
secret-reveal |
Show hidden configuration secrets |
Session Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
session-revoke |
Sign other people out |
Share Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
share-create |
Create share links and see your own | |
share-extend |
Extend your own share links | |
share-revoke |
Revoke your own share links |
Store Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
store-create |
Create your own private store |
Token Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
token-mint |
Make and revoke your own agent tokens | |
token-extend |
Extend your own agent tokens |
User Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
user-read |
View the list of people and their profiles | |
user-edit |
Edit people's accounts | |
user-create |
Create accounts | |
user-delete |
Delete accounts |
Vault Permissions
| Permission | Icon | What it lets you do |
|---|---|---|
vault-proxy |
Let someone acting for you into your vaults |
Total: 39 permissions in 19 groups
Actions (from ACL policies)
[{ConfigAccessor type='actions'}] renders as:
Available Actions (Permissions)
All unique actions defined in access control policies| Category | Actions |
|---|---|
account-security |
account-security
|
admin-read |
admin-read
|
admin-roles |
admin-roles
|
admin-system |
admin-system
|
asset-delete |
asset-delete
|
asset-edit |
asset-edit
|
asset-read |
asset-read
|
asset-upload |
asset-upload
|
audit-export |
audit-export
|
comment-create |
comment-create
|
config-manage |
config-manage
|
identity-manage |
identity-manage
|
identity-read |
identity-read
|
media-read |
media-read
|
page-create |
page-create
|
page-delete |
page-delete
|
page-edit |
page-edit
|
page-export |
page-export
|
page-public |
page-public
|
page-raw-edit |
page-raw-edit
|
page-read |
page-read
|
page-rename |
page-rename
|
profile-manage |
profile-manage
|
proxy-grant |
proxy-grant
|
search-page |
search-page
|
search-user |
search-user
|
secret-reveal |
secret-reveal
|
session-revoke |
session-revoke
|
share-create |
share-create
|
share-extend |
share-extend
|
share-revoke |
share-revoke
|
store-create |
store-create
|
token-extend |
token-extend
|
token-mint |
token-mint
|
user-create |
user-create
|
user-delete |
user-delete
|
user-edit |
user-edit
|
user-read |
user-read
|
vault-proxy |
vault-proxy
|
[{ConfigAccessor type='actions' valueonly='true' before='* ' after='\n'}] renders as:
* account-security
* admin-read
* admin-roles
* admin-system
* asset-delete
* asset-edit
* asset-read
* asset-upload
* audit-export
* comment-create
* config-manage
* identity-manage
* identity-read
* media-read
* page-create
* page-delete
* page-edit
* page-export
* page-public
* page-raw-edit
* page-read
* page-rename
* profile-manage
* proxy-grant
* search-page
* search-user
* secret-reveal
* session-revoke
* share-create
* share-extend
* share-revoke
* store-create
* token-extend
* token-mint
* user-create
* user-delete
* user-edit
* user-read
* vault-proxy
ACL Policies
[{ConfigAccessor type='policies'}] renders as:
Access Policies
Sorted by priority (highest first)| Name | Priority | Effect | Subjects | Resources | Actions |
|---|---|---|---|---|---|
| Administrator Full Access Full system access for administrators - all page and admin permissions |
100 | allow | admin | * |
page-readpage-editpage-createpage-deletepage-renamepage-exportasset-readmedia-readasset-uploadasset-deleteshare-createshare-extendshare-revoketoken-minttoken-extendasset-editsearch-pagesearch-useruser-readuser-edituser-createuser-deleteadmin-rolesadmin-readadmin-systempage-raw-editsession-revokeaudit-exportconfig-managesecret-revealprofile-manageaccount-securitycomment-createstore-createproxy-grantvault-proxy |
| Administrators and demo administrators find and view identity records List, search and view identity records and organizations (#1930). Changing them is identity-manage, admins only. An add-on that needs them grants identity-read to its own roles in its own policy. The id keeps its name from before #2038, so an operator's override of it still merges |
100 | allow | admin, demo-admin | * |
identity-read |
| Administrators change identity records Admins create, edit, delete and link identity records and organizations (#1930). An add-on that needs to change them grants identity-manage to its own roles in its own policy. The id keeps its name from before #2038, so an operator's override of it still merges |
100 | allow | admin | * |
identity-manage |
| User Administrator Permissions Can manage users — create, edit, deactivate, delete |
95 | allow | user-admin | * |
user-readuser-edituser-createuser-deletesearch-userpage-readtoken-mintprofile-manageaccount-securitycomment-createstore-createproxy-grantvault-proxy |
| Demo Administrator (read-only) Demo visitors may view admin screens and edit pages, but change nothing administrative |
90 | allow | demo-admin | * |
page-readpage-editpage-createpage-exportasset-readmedia-readasset-uploadsearch-pageadmin-readprofile-manageaccount-securitycomment-createsearch-userstore-create |
| Editor Permissions Can create, edit, delete, and rename pages plus manage assets |
80 | allow | editor | * |
page-readpage-editpage-createpage-deletepage-renamepage-exportasset-readmedia-readasset-uploadasset-deleteshare-createshare-extendshare-revoketoken-mintsearch-pageprofile-manageaccount-securitycomment-createsearch-userstore-createproxy-grantvault-proxy |
| Contributor Permissions Can create and edit pages, upload assets (no delete/rename) |
70 | allow | contributor | * |
page-readpage-editpage-createpage-exportasset-readmedia-readasset-uploadsearch-pagetoken-mintprofile-manageaccount-securitycomment-createsearch-userstore-createproxy-grantvault-proxy |
| Vault Owner Permissions Everything inside the subject's own vaults — pages and files. The private-container check admits only the owner, so `vault: *` means their own vaults (#1539) |
65 | allow | vault-owner | * |
page-readpage-createpage-editpage-renamepage-deletepage-exportasset-readmedia-readasset-uploadasset-editasset-deleteshare-createshare-extendshare-revoke |
| Reader Permissions Read-only access - can view pages and assets, search, and export |
60 | allow | reader | * |
page-readpage-exportasset-readmedia-readsearch-pagetoken-mintprofile-manageaccount-securitycomment-createsearch-userstore-createproxy-grantvault-proxy |
| Signed-in Self-Service Every account manages its own profile and sign-in methods (#448). Granted to vault-owner, the role every account is given (ngdpbase.user.account-roles), so a session whose site role has stepped down for its required-aal can still reach its profile to enrol a passkey. profile-manage, account-security (#1525), and search-user: every user may search for other users (operator, 2026-10-24, #2018), so the people pickers work for every account. Nothing else. |
60 | allow | vault-owner | * |
profile-manageaccount-securitysearch-user |
| Make pages public Move one's own general and capture pages out of their vault (#1504): the roles that can have private pages today. The journal add-on grants the same for journal pages in its own policy, journal-page-public (#1507) |
60 | allow | reader, contributor, editor, user-admin, admin, demo-admin | general capture |
page-public |
| Anonymous Read Access Anonymous users can read pages and attachments, and search pages |
50 | allow | anonymous | * |
page-readasset-readsearch-page |
Authentication Methods
[{ConfigAccessor type='authMethods'}] renders as:
agent-tokenDisabled
default-ttl-hours | 24 |
directory | ./data/tokens |
max-per-user | 10 |
max-ttl-hours | 24 |
retention-days | 1 |
sweep-interval-seconds | 60 |
authentik-bearerEnabled
audience | kvBwSzZ2P2X0UqGXfrQ8JxBKKn3uOSDcRQaI2QBE |
default-role | occupant |
group-map | {} |
issuer | https://auth.nerdsbythehour.com/application/o/ngdpbase/ |
jwks-url | https://auth.nerdsbythehour.com/application/o/ngdpbase/jwks/ |
cloudflare-accessDisabled
application-aud | — |
default-role | reader |
group-map | {} |
team-domain | — |
credentialsDisabled
file | ${FAST_STORAGE}/users/credentials.json |
email-changeDisabled
cooldown-seconds | 60 |
max-per-window | 5 |
ttl-minutes | 60 |
window-minutes | 60 |
google-oidcDisabled
auto-provision | true |
callback-url | — |
client-id | — |
client-secret | — |
default-roles | ["reader"] |
deny-redirect | /login?error=Access+denied |
hd | — |
invitationDisabled
ttl-days | 7 |
magic-linkDisabled
auto-provision | false |
bind-to-requesting-device | false |
registration.default-role | reader |
ttl-minutes | 15 |
oidcDisabled
auto-provision | false |
providers | {} |
passkeyEnabled
passwordEnabled
proxy-accessDisabled
throttleEnabled
lock-minutes | 1 |
max-attempts | 10 |
max-lock-minutes | 15 |
window-minutes | 15 |
userDisabled
default-external | false |
General
factors | [{"authproviderid":"passkey","primary":true,"amr":["swk","user"],"aal":2,"acr":"phr","enabled":true},{"authproviderid":"password","primary":true,"amr":["pwd"],"aal":1,"enabled":true},{"authproviderid":"magic-link","primary":true,"amr":["email"],"aal":1,"enabled":true},{"authproviderid":"oidc:google","primary":true,"amr":["trust"],"enabled":true},{"authproviderid":"cloudflare-access","primary":true,"amr":["trust"],"enabled":true}] |
step-up | {"max-age-minutes":60} |
Features
[{ConfigAccessor type='features'}] renders as:
Features
export
html | true |
odt | false |
pdf | false |
imagesEnabled
default-alt | Uploaded image |
default-class | wiki-image |
llmDisabled
endpoint | http://localhost:11434 |
model | llama2 |
maintenanceDisabled
allow-admins | true |
estimated-duration | |
message | System is currently under maintenance. Please try again later. |
Current User Summary
[{ConfigAccessor type='user-summary'}] renders as:
Current User Summary
Your roles and permissionsLogin Status
Not Authenticated We recognize you but you are not currently authenticated. Login to access all features.
User Information
| Username: | Anonymous |
| Display Name: | Anonymous User |
Your Roles
Anonymous
System
Public access without authentication
Public access without authentication
Your Permissions
| Permission | Granted By Role(s) |
|---|---|
asset-read
View assets (attachments) |
Anonymous |
page-read
View pages |
Anonymous |
search-page
Search pages |
Anonymous |
User Keywords
[{ConfigAccessor type='userKeywords'}] renders as:
User Keywords
User-defined keywords for content tagging and organization| Label | Description | Category | Enabled | Restrict Editing | Allowed Roles |
|---|---|---|---|---|---|
default |
Default keyword with no special restrictions | general | Yes | No | - |
[{ConfigAccessor type='userKeywords' enabled='true' valueonly='true' before='* ' after='\n'}] renders as:
* default
System Keywords
[{ConfigAccessor type='systemKeywords'}] renders as:
System Keywords
System-defined keywords for controlled vocabulary| Label | Description | Category | Enabled | Default | Schema.org |
|---|---|---|---|---|---|
anthropology |
Human culture and society content | subject | Yes | No | - |
capture |
Machine provenance: page created by the capture bookmarklet (#881/#893) | provenance | Yes | No | - |
economics |
Economic and financial content | subject | Yes | No | - |
general |
General-purpose keyword for standard wiki content | content-type | Yes | Yes | - |
geology |
Geological and earth science content | subject | Yes | No | - |
medicine |
Medical and healthcare-related content | subject | Yes | No | - |
meteorology |
Weather and atmospheric science content | subject | Yes | No | - |
oceanography |
Ocean and marine science content | subject | Yes | No | - |
political-science |
Political science and governance content | subject | Yes | No | - |
psychology |
Psychological and behavioral science content | subject | Yes | No | - |
sociology |
Social science and society-related content | subject | Yes | No | - |
test-artifact |
Provenance: created by an automated test, probe or script run — not content, safe to delete. Stamped by the system, never typed by users | provenance | Yes | No | - |
test-page |
Purpose: a test page — one content shape the unit tests render through the real pipeline; admin-only via audience (#1355) | provenance | Yes | No | - |
System Categories
[{ConfigAccessor type='systemCategories'}] renders as:
System Categories
System categories that determine page storage location| Label | Description | Source | Enabled | Default |
|---|---|---|---|---|
addon |
Documentation about an installed add-on, seeded by it | required-pages | Yes | No |
capture |
Pages made by the capture bookmarklet | pages | No | No |
developer |
Developer documentation and technical notes, only in GitHub | docs | No | No |
documentation |
End-User documentation | required-pages | Yes | No |
general |
General User pages | pages | Yes | Yes |
journal |
Personal journal entries — schema.org BlogPosting at JSON-LD render time (#791) | pages | No | No |
system |
The minimal viable pages for a minimal site to start | required-pages | Yes | No |
user-profile |
User profile pages | pages | No | No |
[{ConfigAccessor type='systemCategories' storageLocation='required'}] renders as:
System Categories
System categories that determine page storage location| Label | Description | Source | Enabled | Default |
|---|---|---|---|---|
addon |
Documentation about an installed add-on, seeded by it | required-pages | Yes | No |
capture |
Pages made by the capture bookmarklet | pages | No | No |
developer |
Developer documentation and technical notes, only in GitHub | docs | No | No |
documentation |
End-User documentation | required-pages | Yes | No |
general |
General User pages | pages | Yes | Yes |
journal |
Personal journal entries — schema.org BlogPosting at JSON-LD render time (#791) | pages | No | No |
system |
The minimal viable pages for a minimal site to start | required-pages | Yes | No |
user-profile |
User profile pages | pages | No | No |
Manager config
[{ConfigAccessor type='manager' manager='PageManager'}] renders as:
PageManager Configuration
| Property | Value |
|---|---|
enabled |
true |
Feature config
[{ConfigAccessor type='feature' feature='search'}] renders as:
search Feature Configuration
| Property | Value |
|---|---|
enabled |
false |
Notes
type='authMethods'— sensitive fields (client secret, tokens) are masked for non-admin users.- Plugin name is case-insensitive:
[{configaccessor}]and[{ConfigAccessor}]are equivalent. captiononly applies to singlekeylookups — ignored on wildcards andtypeinvocations.noheaderapplies to both single and wildcardkeylookups.pageSizeonly applies to wildcardkeylookups — ignored on single keys andtypeinvocations.- Pages that expose sensitive configuration should be restricted to admin or editor roles.
No comments yet.