Atria Dashboard Access Model

Overview

This document describes a simple tag-based access model for dashboards in the Atria application.

• Users are identified by email

• Each user has a list of dashboard tags

• Each dashboard exists as a React route

• A user can access a dashboard if and only if they have the matching tag

Example

There is no additional mapping layer.
Tags == dashboard routes.

Core Concept

• DynamoDB stores users and their tags

• React routes are named to match tags

• Authorization is performed by checking whether the user has the tag that matches the route

Frontend (React)

Purpose

Provide dashboard access based on the authenticated user’s tags.

Flow

1. User logs in via Amazon Cognito

2. Frontend calls GET /me/tags

3. Backend returns the user’s tag list

4. Frontend:

   • Displays only dashboards the user has access to

   • Prevents navigation to routes without matching tags

Routing Model

Each dashboard is a route that directly matches a tag:

Examples:

• /monitor/water-dashboard

• /monitor/gateways-dashboard

UI Behavior

Dashboard List Page

• No tags:

  You currently don’t have access to any dashboards. Please contact your administrator.

• Has tags:

  • Render one dashboard card per tag

  • Clicking a card navigates to /monitor/{tag}

Dashboard Page

• On load:

  • Verify the route tag exists in the user’s tag list

  • If not, display an Access Denied message

Backend (AWS Lambda + API Gateway)

Purpose

• Return the authenticated user’s dashboard tags

• Allow admins to manage user tags

• Serve dashboard data after access validation

API Endpoints

Authorization Rule

A request to /dashboard/{tag} is allowed only if:

DynamoDB Data Model

Table: UserTags
Stores users and their dashboard access tags.

Key Schema

Attributes

Example Item

Dashboard Definition

Dashboards do not exist in DynamoDB as entities.

A dashboard is defined by:

• A React route: /monitor/{tag}

• A frontend component (e.g. WaterDashboard.jsx)

• A backend data query tied to {tag}

Backend Data Access Flow

When /dashboard/{tag} is requested:

1. Lambda extracts the user email from Cognito

2. Fetches the user record from DynamoDB

3. Validates {tag} exists in Tags

4. If valid:

   • Query AWS Timestream / DynamoDB

5. If invalid:

   • Return 403 Forbidden

DevOps / Infrastructure

AWS Services

• Amazon Cognito – Authentication

• DynamoDB – UserTags table

• AWS Lambda – API logic

• API Gateway – HTTP endpoints

• AWS Timestream – Time-series device data

• Infrastructure as Code – CDK / Terraform / CloudFormation

IAM Permissions

Access Summary

• Users have tags

• Tags define dashboard access

• Routes map directly to tags

• No tag = no access

This approach is:

• Simple

• Explicit

• Easy to secure

• Easy to extend (add a dashboard = add a tag)