Security | Kantan Desk

RBAC model

Admins, superadmins, roles, teams, and requesters each have a different job.

Kantan Desk uses role-based permissions for staff controls and ticket-specific ownership checks for requester access.

SuperAdmin	Can bypass permission checks and is required for creating inbound API keys.
Admin	Receives the full effective permission list in the application’s role resolver.
Role-based staff	Receives the union of assigned role permissions when roles are active.
Roles inactive fallback	When RBAC is not in use, protected routes require elevated access rather than open access.
Team members	Can be grouped into teams with admin/member responsibilities and scoped ticket, mailbox, webhook, tag, and client access.
External requesters	Do not require staff RBAC roles to view or reply to their own tickets; route-level ownership checks authorize their ticket access.

Fine-grained permissions

The permission set goes well beyond “admin or user.”

The project defines explicit permission groups for support work, administration, integrations, observability, privacy, storage, and AI assistance.

Issues

Create, read, write, update, delete, assign, transfer, and comment.

Users

Create, read, update, delete, lock, and manage user accounts.

Roles

Create, read, update, delete, and manage role definitions.

Teams

Create, read, update, delete, and manage teams.

Clients

Create, read, update, delete, and manage client records.

Knowledge base

Create, read, update, delete, and manage knowledge-base content.

Documents

Create, read, update, delete, manage documents, and manage views.

Time tracking

Create, read, update, and delete time entries.

Webhooks

Create, read, update, delete, plus broader webhook management.

Email queues

Create, read, update, delete, manage mailboxes, and approve mailbox change requests.

System settings

View/manage settings, manage integrations, and manage email templates.

Security operations

Manage MFA, read audit logs, read/delete logs, and read/manage monitoring.

Privacy

Manage verified privacy export and deletion workflows.

Storage

Read/manage storage and attachment controls.

Digest and suppression

Read/manage statistics digests and email suppression settings.

AI

Use internal AI chat where the feature is enabled and configured.

Multi-factor authentication

TOTP MFA with admin enforcement.

Kantan Desk supports voluntary MFA, admin-required MFA, reset workflows, backup codes, and audit events.

TOTP uses standard 6-digit codes with a 30-second step and a small clock-drift window.
Each user receives a unique generated secret; TOTP secrets and backup codes are encrypted at rest with AES-256-GCM.
Users receive 10 single-use backup codes, displayed once during setup.
Admin-required MFA forces setup on next login and blocks dashboard access until setup is complete.
Admin reset clears MFA secrets, backup codes, enabled status, and active MFA sessions while preserving the requirement flag.
MFA verification is rate-limited with progressive lockout protection covering both per-IP and account dimensions.
MFA actions are recorded in audit logs, including enable, disable, backup-code regeneration, require, unrequire, and reset events.

Secrets

Separate production secrets

Production requires separate base64 secrets for JWT signing (SECRET) and stored-data encryption (DATA_ENCRYPTION_SECRET).

Encryption

Protected credentials

Protected stored credentials and integration secrets use authenticated AES-256-GCM encryption where the application must recover the original value.

Hashing

One-way material

Passwords, API keys, and verification material use one-way hashing where Kantan Desk does not need to recover the original value.

Sessions

Session checks

Full sessions are backed by database session rows, with hardened binding controls available for deployment-level protection.

CORS

Explicit origins

Production requires explicit CORS origins, and wildcard origins are rejected in production.

Backups

Recoverability planning

PostgreSQL, Redis persistence, uploaded files, and encryption secrets all matter. Losing DATA_ENCRYPTION_SECRET can make encrypted integration credentials unrecoverable.

Authentication

Staff SSO via OIDC

Admins can configure an OIDC provider for staff login. Kantan Desk acts as a relying party; session creation follows the same audit-logged flow as password login.

Audit integrity

Tamper-evident audit trail

Each audit log row stores a SHA-256 chain hash linking it to its predecessor. Deletions, modifications, or reorderings break the chain and are detectable. Chain integrity is maintained continuously; a SuperAdmin endpoint can walk the complete chain and surface the first point of divergence.

Credential handling

One-way reset codes

Password reset codes are SHA-256 hashed before storage. The plaintext code is never written to the database; only the hash is compared on submission.

Login protection

Multi-layer login controls

Login attempts are subject to layered rate limiting and timing protections covering both IP and account dimensions. Unknown-user paths are designed to produce equivalent response characteristics to valid-user paths to reduce information leakage.

Audit trail in practice

Every administrative action produces a signed, chained record.

Audit entries capture the event, actor email, target, risk level, and a SHA-256 hash linking each row to its predecessor. A broken chain is detectable without relying on log access controls alone.

Event	Actor	Risk	Chain hash
LOGIN_SUCCESS	[email protected]	low	`a3f82c…`
CLIENT_CREATED	[email protected]	low	`7de419…`
SSO_PROVIDER_UPDATED	[email protected]	high	`2bc06e…`

Accurate boundary

Private support software, not end-to-end encryption.

Kantan Desk is designed for private support operations, but the server must be able to read ticket content to provide ticketing, search, email, portal, automation, and administrative workflows. MFA applies to user login sessions; API keys and webhooks are authenticated separately through HMAC signatures and IP allowlists.

Fine-grained control is one of Kantan Desk’s strongest signals.