RBAC/ABAC - Implement Role-Based Permissions

[Alon Peretz]

Task Description

Enhance our application's security model by integrating SuperTokens' User Roles recipe to support both Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) in a multi-tenant environment. This task involves setting up roles, permissions, and attribute checks, assigning roles to users, and safeguarding API and frontend routes based on these criteria.

Acceptance Criteria

• SuperTokens User Roles recipe is initialized within the application, supporting multi-tenancy.
• Roles and permissions are effectively managed across all tenants.
• Users are assigned roles with a consideration for the tenant context.
• API and frontend routes are protected, with access control decisions made based on a combination of roles, permissions, and user attributes.
• The system dynamically updates session information to reflect changes in user roles, permissions, or relevant attributes.

Implementation Instructions

1. Initialize SuperTokens with User Roles Recipe

• Incorporate the User Roles recipe during the backend's initialization phase of SuperTokens, ensuring it's configured for multi-tenancy and ABAC by including user attributes in session tokens when necessary.

2. Define Roles, Permissions, and Attributes

• Define roles and permissions typical to your application's access control requirements. Additionally, identify user attributes relevant to ABAC, such as department, job title, or access level.
• Create interfaces or mechanisms for managing these attributes alongside roles and permissions, ensuring they can be updated and managed efficiently.

3. Assigning Roles and Attributes to Users

• Develop processes for assigning roles and attributes to users, considering the specifics of each tenant. This might involve an admin interface or automated assignment based on business logic.
• Adjust the session creation logic to include both roles and user attributes in the session data, facilitating access control decisions.

4. Protecting API Routes with RBAC and ABAC

• Implement NestJS guards or middleware that verify a user's session, roles, and attributes before allowing access to protected routes. Leverage SuperTokens' verification alongside custom logic for attribute checks.
• Ensure that the access control logic for APIs takes into account the tenant context, validating roles and attributes within the correct tenant scope.

5. Frontend Route Protection

• Extend the frontend's session management to consider user roles and attributes when guarding routes or features. Implement reactive guards that adapt to changes in user sessions.
• Develop UI components or services that can interpret and enforce access controls based on both roles and attributes, ensuring a seamless user experience.

6. Handling Changes in Roles or Attributes

• When updates to a user's roles, permissions, or attributes occur, ensure these changes are promptly reflected in their session. This may involve mechanisms to fetch and set updated claims in the session.

Resources

• SuperTokens Documentation: User Roles Recipe
• NestJS Guards: https://nestjs.com/docs/guards
• Multi-Tenancy and ABAC Overview: Ensure familiarity with concepts to effectively implement solutions.

Notes

• Regularly review and update the attributes and roles as your application evolves to ensure the access control system remains effective and relevant.
• Thoroughly test the implementation with varied user scenarios to ensure the access controls are correctly enforced across different tenants.