Permissions & Feature Limits

LaunchKit Pro combines RBAC permissions, feature flags, and plan limits to control what each user can do in a workspace.

RBAC permissions

Permissions are string keys (e.g. workspace.view, billing.manage, files.delete). Routes use @RequirePermission and PermissionsGuard.

Examples:

Permission	Purpose
workspace.view	View workspace
workspace.update	Update workspace
member.invite	Create invites
member.update_role	Change member roles
billing.view / billing.manage	Billing read/write
files.view / files.upload / files.delete	Storage
api_keys.manage / webhooks.manage	Developer tools
admin.access	Platform admin routes

Workspace roles map to permission sets. Platform admins have separate admin permissions.

Inspect your role:

curl -s http://localhost:4000/permissions/me \
  -H "Authorization: Bearer <accessToken>" | jq

Feature flags

Feature catalog describes modules (AI, storage, webhooks, etc.) and which plan codes enable them.

curl -s http://localhost:4000/features/catalog | jq
curl -s http://localhost:4000/features/editions | jq
curl -s "http://localhost:4000/features/editions/current?workspaceId=<workspaceId>" \
  -H "Authorization: Bearer <accessToken>" | jq
curl -s http://localhost:4000/workspaces/<workspaceId>/features \
  -H "Authorization: Bearer <accessToken>" | jq

See Product Editions for the Lite / Pro / Enterprise matrix foundation (informational defaults; enforcement still uses plan limits below).

If no active subscription exists, Lite defaults apply.

Plan limits

Plans (lite, pro, enterprise) define numeric limits — API keys, webhooks, AI usage caps, storage quotas, etc.

curl -s http://localhost:4000/workspaces/<workspaceId>/limits \
  -H "Authorization: Bearer <accessToken>" | jq

Admins can adjust workspace upload limit via PATCH /workspaces/:workspaceId/limits (subject to plan ceiling).

Upload limit formula

Effective max upload size (MB) is the minimum of:

1. System limit — MAX_UPLOAD_SIZE_MB (backend env)
2. Plan limit — from active subscription plan
3. Workspace setting — optional override from workspace limits API

effectiveLimit = min(systemLimit, planLimit, workspaceSetting)

Enforcement layers

Layer	Purpose
Frontend	NEXT_PUBLIC_MAX_UPLOAD_SIZE_MB pre-validation (UX only)
Backend	Authoritative rejection with clear error message
Nginx	client_max_body_size hard limit at reverse proxy

All three should be aligned in production. Frontend validation alone is not sufficient.

Example Nginx (API server block):

client_max_body_size 10m;

403 permission denied

Means the user is authenticated but lacks the required permission for that workspace or admin route. Check role, workspace membership, and plan features.

Related

• Billing — plans and subscriptions
• File Storage — upload configuration
• Troubleshooting — 403 errors