The Studio

The Studio is compiled into the server and served at /. It talks to /admin/v1 and nothing else — every screen here is a view over an API you can call yourself. Its accounts live in the control database and have nothing to do with your application's users.

Signing in

Open the instance root and sign in with the credentials scripts/setup.sh printed on the first boot. That account lives in control.platform_users, in the control database, and is created by scripts/migrate.js from BASELYRA_ADMIN_EMAIL and BASELYRA_ADMIN_PASSWORD.

POST /admin/v1/login is capped at five attempts per minute per IP: it is the one route on the instance that turns a password into a token holding service_role, and it is reachable without any credential.

The database page

Schemas are grouped the way the server groups them: your schemas first and expanded, auth and storage collapsed under System, and baselyra, pg_catalog, information_schema and pg_toast not returned at all. Every table carries a planner row estimate and its RLS state.

The pages

Cmd + K opens a command palette that jumps between pages, tables and actions. Below the md breakpoint the sidebar becomes a drawer and every table scrolls inside its own container.

The SQL editor

The editor defaults to read-only. Flipping the segmented control beside Run to Write tints it with the warning colour, because that is the mode that can drop things. Cmd + Enter runs the selection, or the whole statement when nothing is selected.

{"columns":[{"name":"count","type":"int8"}],
 "rows":[{"count":"3"}],
 "rowCount":1,
 "durationMs":4,
 "command":"SELECT"}

Three properties are worth knowing before you use it:

• It runs as baselyra_sql, not as the server's own login role. That role keeps every object right the owner has — including reading every password hash in auth.users — and loses access to the host. See The SQL editor.
• The audit row is written before the statement runs, on a separate connection, so a statement that fails or rolls back is still recorded. It contains the statement text: do not type a password into the editor and expect it to be forgotten.
• A viewer may run read-only statements and nothing else. The write half of that decision is made from the request body, at the one point that can see it.

Studio accounts

Changing your own email or password requires current_password. You cannot delete your own account, and you cannot delete or demote the last owner — an instance with no owner cannot be recovered from the Studio at all, only by an INSERT into control.platform_users from psql against the control database.

Roles and capabilities

Three roles ship, and they are rows rather than constants — an owner can add more with their own capability set.

A capability is checked per route, against the pattern the route was registered with, using the list inside the token's signature:

database.read   database.write   database.ddl
sql.read        sql.write
auth.read       auth.write
storage.read    storage.write
realtime.read   realtime.write
import.run
settings.read   settings.write   keys.read
email.read      email.write
logs.read
team.read       team.manage

Tokens are stateless

A Studio token lasts one hour and nothing is stored server-side. No route re-checks the account row, so:

• Signing out records an audit entry and nothing more.
• Deleting an operator's row stops them signing in again; a token already issued keeps working until it expires, at most an hour later.
• To cut every Studio token off at once, rotate JWT_SECRET — which also invalidates both project keys and every application session.

The service key is a second way in and always has been: it is the instance's own credential, it predates any Studio account, and /admin/v1 accepts it so scripts and first-boot recovery keep working. It has no /me, because it is not a person.

What the Studio does not have

The audit log

Every Studio sign-in, SQL execution, DDL statement, policy change, settings write and import is written to control.audit_log — in the control database, so the SQL editor cannot read it and an operator cannot quietly edit their own trail.

curl -s "$URL/admin/v1/logs?limit=100" -H "authorization: Bearer $ADMIN_TOKEN"

Read it under Studio → Settings. Import runs redact as they go: connection strings, passwords and API keys are replaced in the audit row, in the control.import_runs summary, in the progress stream and in error messages.

Failure modes

Edit this page Report a problem