Multi-user / permission support

[deajan]

So basically I wrote about this earlier in zadam's post about trilium's maintenance status.

This has been one of the major feature quite a lot of people asked for.
Making trilium multi-user friendly, eg:

• Add a permission system for notes (ie CRUD permissions)
• Add user authentiication in order to get permission on a per user basis
• Optionally add groups

The major benefit I see here is the traction that TriliumNext would get, ie it would be used in enterprise where people usually document with wiki like systems (ex docuwiki).

Someone stated in the original issue that Trilium is a PERSONAL knowledge base, but IMO tadding optional permissions wouldn't bother people who like to use it that way.
Still il would allow sharing the same knowledge base accross multiple users, personal or professionnal wise.

From a developper point of view, I think the major problem here is that notes hierarchy isn't fixed, and notes can be cloned, so the most complicated part would be to make permissions inheritance on notes that have multiple parents.
This could perhaps be solved by having a note owner, which is the only user which permissions are being inherited.
That of course would also need a way to change the ownership of the notes.

Anyway, I am really hoping this idea to get picked up, since it would probably mean way more people attracted to the project.

[zerebos]

I think this in general is a very good idea to include. As you said, it's probably the most asked for feature from what I've seen. But even from what you've described, there's multiple ways this can be handled. We can have multiple users using the same instance but completely different databases, or we can have them split up but within the same database, or we can do as you suggest with a full permission system that would have users potentially working in the same hierarchies.

There's a lot to think about here. The simplest one to do is have multiple users on the same "instance" but using separate databases. That would still allow it to be a personal database rather than a collaboration platform that has users on the same hierarchies.

[edgeTurbo]

@eliandoran Indeed, as you said, I have updated the user information into the session, but now there is a problem that is bothering me. I am unable to globally obtain the session corresponding to the request. I want to make the smallest possible changes, so I want to use the global session retrieval method in sql.ts to obtain the dataDir of the corresponding user, and then dynamically change the database file in sql.ts. But I don't know how to obtain the session globally. It seems that it can only be obtained through routing. I am not very familiar with Node.js. If there is a solution, please let me know. Thank you!

[edgeTurbo]

[eliandoran]

@edgeTurbo , you could try to hook into auth.ts in the checkApiAuth. This method appears to be called before every API request. You there have access to the req.sessions and you can then call sql to tell it to change database.

[edgeTurbo]

@eliandoran Thank you very much for your suggestion. I am able to continue writing the code. Indeed, when requesting interfaces, I always go to the checkApiAuth method. Now, I am using cls-hooked to retrieve the corresponding user's database in sql.ts.Here are some of the code modifications I made



It can indeed produce some effects, but unfortunately, when the service starts, it will perform sql_init.initializeDb() and write it to the Rebecca object. After I block sql_init.initializeDb(), I will get an error Error: get /api/tree thread exception: 'Note' root 'not found in the cache', stack: undefined. The reason should be that the becca object does not exist. After login is successful, it will jump to '/' route. When rendering in index.ts, the database needs to be queried, but there is no user database instance in the namespace at this time. Therefore, when the service starts, some queries will go to the original database instance. Only when a request is made. When using the API, it will go to checkApiauth to generate a database instance. How should I solve this? I am very sorry, my coding skills are very beginner, and I hope you can give me more help

[edgeTurbo]

@eliandoran I found that when the service starts, the becca object is initialized. When obtaining notes or trees, it is obtained from becca object. However, different databases obtain the same becca object because the app. ts initializeDb func, and at this time, the database instance is still initialized through The database instantiated by 'dataDir.DOCUMENT_PATH'. So when I switch to a new database for querying the information in the DOCUMENT_PATH of the becca object, I will retrieve the note ID from becca to request the database, and at this time, an error will be reported stating that the note_id is not in the database. I don't know if it's the situation I described, could you please provide me with more help or ideas

[zadam]

I'll add my 2 cents.

I'd start by gathering what use cases would Trilium Next want to target. "multi-user" or "permissions" are very generic terms which can span from very simple multi-tenancy to extremely complicated systems. It would be good to find a good balance of the most useful use cases covered, fit to the existing Trilium features / philosophy, and the implementation cost needed.

The other thought I have is this - it looks like the new org highest priority is refactoring. I'd recommend focusing on that first before tackling such major features as multi-user. It's good of course to think about the future, but not diverting attention into 10 different directions is IMHO an important consideration too.

[meichthys]

it looks like the new org highest priority is refactoring

could you link discussions about this?

@rmkni See here:
https://github.com/orgs/TriliumNext/discussions/26

https://github.com/orgs/TriliumNext/discussions/4

[meichthys]

I would be supportive of being able to export and import trees to/from some text format though, that would be nice.

I think we can already do this with the normal import/export feature, no?

[alrhalford]

Quite possibly, I haven't used that functionality - apologies if it is!

[maphew]

Looking for shared trees is what brought me to this thread. My use case is: the hub of my star topology is at home on my NAS, with spokes being desktop, laptop, phone, and work computers. Where I want to be is that, plus: an Trilium server that has only certain branches of my database. These branches would be used as Shared, giving me a website of my knowledgebase but not risking exposing everything should the public server be compromised.

I think this scenario could dovetail nicely with multi-user. Imagine certain branches being tagged #sync:https/hostname.net/path/ and automatically synchronized using the regular mechanism. Each sync host manages their own permissions locally no different than now, with one new password / authentication mechanism just for the sync api.

(Thinking more broadly, the destination for this imagined #syncTarget tag need not be restricted to http. e.g. it could be another sqlite db on disk, or even a 'real' rdbms like postgres, an rsync daemon, or scm like fossil or git.)

That said, as much as I would like this tomorrow! I agree the current refactoring effort should have priority.

[Phalen]

First of all I must state this BLOWS onenote out of the water. This is every thing i wanted out of onenote and so much more.... THANKYOU!!!

As for the multi user aspect you first have to decide 3 things. ;)

1 are you going to replace onenote or sharepoint in style.
2. should each root be its own database and have its own password/security kinda like how onenote can open multiple notebooks/ share point you have your "my site" and then you can also attach/map team sites, and even some one elses "my site" or one large conglomerate database thing that needs mysql or other larger databases to handle the security and different style of access.
3. do you plan to eventually allow/make it big enough for an enterprise which partially falls under #2 for what type of database style.

I can see this product be loved by entire households as well as smb and possibly medium businesses pretty much any which way you take it.

I could see this becoming a offline capable sharepoint honestly. If you figure out the right way to do the front end i could seriously see it being used every where.

Since it is refactoring time i would suggest determining at least the general frame work you want to use to go multi user so during the refactor you can see what parts need adjustments to handle multi users and possibly even lay ground work for when you start coding in the user support.

[eliandoran]

@sigaloid , as developer of trilium.cc, what's your take on this?
Without going in too much detail, how does trilium.cc achieve multi-user support?
Is there something we can implement in the server to ease multi-user support?

[sigaloid]

Unfortunately, I don't do any real multi-user support - I simply dockerize each server and run each one separately (with separated data volumes).

I wouldn't want to have one server with multiple users anyway - the containerization is very helpful in terms of security (a vulnerability in the code base isn't remote shell - just a docker container).

side note: this is also why I've been researching alternative runtimes like deno or bun - I pay the Node runtime cost for every single container which means compute is far more than ideal. Also why I've looked into writing a Rust backend as a sync target.

[deajan]

Some kind of multi-tenanncy can be be achieved by running multiple trilium instances with different trilium-data dirs.
Realtime collaboration is another beast, which is FAR from the most needed I guess.

@rauenzi Having the same database for multiple users would be the best IMO.
The usecase I'm targetting here is sharing notes with family / collegues, for them to see and/or edit, depeding on permissions.

[meichthys]

Having the same database for multiple users would be the best IMO.\nThe usecase I'm targetting here is sharing notes with family / collegues, for them to see and/or edit, depeding on permissions

Yes. This seems to be the most requested use case from what ice seen in past issues.

[alrhalford]

I would be interested to know the extent to which people want to collaborate on an entire instance. A couple of thoughts:

The ability to share an authenticated link that gives the recipient r or r/w access to a particular note tree, a bit like google docs does. The downside of this is that it becomes difficult to say "they can read this note tree, but only edit this subtree, etc", but the upside is that it should be easy to implement, and permissions are easy (if not super expressive).

The idea of "remote notes" in your own trilium instance that reference a note tree that is stored elsewhere. The downside is that you need your own trilium instance, but the upside is that it slots in quite nicely without re-engineering the existing stuff too much.

[deajan]

As of today, links to note trees are a simple HTML representation of the notes, without any editor function.
Having an authenticated link like you suggest would mean for a foreign user to get access to the whole Trilium interface, with all the frontend JS/plugins, which would probably lead to major security issues.

Also, "remote notes" could simply disappear without further notice, which is also not a good practice in terms of note taking.

From what I understand, the major multiuser need here is to have multiple users collaborate on the same Trilium instance.
Each user could have private notes, and view/edit group notes.
@meichthys What's your take on this ?

[alrhalford]

To be clear, I personally don't see the value in multi user, but to address your points:

Authenticated links: Clearly the authenticated link would not work now, work would need to be done to allow such links to be scoped to particular note trees, and the backend would only return the note trees that are within scope.

Remote notes: you're right, somebody could delete a remote note and it would disappear, but this is not so different from normal collaboration tools - if you and I collaborate on a Google doc/notion etc, I could just wipe/delete a page and it would disappear for you (local backups, versioning, etc notwithstanding).

[meichthys]

@deajan I do agree that multi user had significant benefits in cases like a small office, or family scenarios where there are multiple people who are expected to have read write access on a regular basis.
I have a deployment in a small office and we currently only have one way to restrict access to certain note trees (password protecting with the instance password). We logged in each user with the instance password (but never gave the password to them h this way we can 'reuse' the password to lock down 'IT or sensitive sections' of the notebook.

Some multi user discussions happened here: zadam#3921 <–– see this discussion for a list of old issues requesting this kind of feature
zadam#1375
zadam#3024

To me it breaks down to two categories: users that want to be able to just have two databases on the same instance (multi tenancy), and users who want some kind of better collaboration (whatever collaboration means).
A read\write authenticated link would satisfy a portion of the use cases, but not most from what I've seen in previous requests for these kinds of features.

[GitTimeraider]

Can add a vote for this.
But I also have to agree that unless some major parts get overhauled, I feel like most people would be more than fine already with multiple people having acces to the same database data and a very basic permission system (even if it does start off with having to literally tag everything with specific usernames)

More advanced stuff can be kept in mind during development but might not need to be a primary focus.
Not sure how many people are going as far as to suggest "collaboration" options, but not sure whether its to great of an idea to get to far into that.
Im all for more features and if stuff is possible it is nice, but I feel like full-on collaboration projects and notes simply work better in dedicated software so not sure whether that will lead to feeling like to much is crammed into 1 packages while not all of it will be as fleshed out.

[Br0kenSilos]

My use case its pretty simple although the implementation may or may not be. The ability to have multiple family members login using their own passwords. Once logged in, permissions (ie Master, Edit, Read-only, Share) could define their access levels to individual branches of the main tree only and propagate down through the sub-branches. A Primary "Master" would have full access to the whole tree. Then the individuals could further control their own branch downward. So For instance..

ROOT (Master)
\Dad's Notes (Dad)
\Mom's Notes (Mom)
\Kid 1 Notes (Kid 1)
\Kid 2 Notes (Kid 2)
\Family Shared (All Members)

[deajan]

@Br0kenSilos Sounds to be a pretty good usecase. Add "parents" and "children" groups to the permissions, and I'm all in ;)

[CrO2Cl2]

to add something: I think High Availability is a must for multi user support, in case there are any very big instances. You can already "chain" multiple servers together, but it would be nice to be able to make "web" of servers instead of just a chain
(issue that asked for HA: zadam#2654 )

[0xStuart]

I have been using DekiWiki for nearly 20 years before it was commercialised into MindTouch. Until now, I have been unable to find anything to replace it with.

Trilium is DekiWiki without the user privileges. It's the simplicity of DekiWiki, that made it very useful. You could re-skin it to make web sites, and hide the login page. It would default to read-only, and became very popular with web developers.

All Trilium needs, is the ability to create users, and groups, with read/write attributes which can be attached to documents.

[maphew]

Another deki-user! It/Mindtouch was the only notes system which worked equally well for me at home as well as work. I poured so much energy into adapting and using it. The burn from them abandoning their established customer base on pursuit of 'enterprise' still hurts. And it's not like I wasn't willing to pay for both deployments. Unlike you I didn't stay with it. I came in at the early Mindtouch transition and only had deki for a few months. Onenote is what I ended up settling in the intervening fifteen years.

I echo your opinion that Trilium is the only thing I've found that could be a suitable replacement.

[meichthys]

As per our latest community meeting and discussion, i gather that multi-user or multi-tenant use cases are relatively high on the priority list (once the app and delivery pipelines are stable and testable.)

[glaucon1984]

I think it would be easier to implement a system where multiple users can have a DB in a single server, and leave collaboration for the future.
It's already possible to export/import a tree of notes and even sharing through URL.

If there was a minimum level of LDAP integration this could be a great tool in the enterprise. There are already collaboration and sharing tools like SharePoint and OneNote, that most companies use, but those tools are slow and hard to use when one just wants to keep some notes. And you end up with people having hundreds of untitled notes in Notepad++ that are impossible to organize or search.

As stated, it's a personal knowledge base, and I'd really love to put it in my workplace, so each worker can have their personal knowledge base without concerns for sensitive data being posted in some random cloud service.

But I cannot deploy and manage one instance per user.

Give me multi-user with LDAP integration so I can rely on AD authentication and group membership for the access, and I would start immediately doing the paperwork to get the app approved in my workplace.

The behaviour of the Windows application sync'ing with the web server is perfect for our use case, users can run the Windows app in their company laptop and have access to their notes even offline, and as soon as VPN is available then they can sync with the server, which we can make sure is properly backed up.

Also, our security team will be very happy to approve an open source project that will always keep the data within the company infrastructure.