Motivation

Basic motivation here is to "flatten" out RBAC permissions in order to make them more generic, action-based, and human readable. The assumption of different "levels" (ie. ReadWrite -> Write -> Read) is instead replaced with generic tokens that can be enumerated in an array, allowing different actions to be easily added and scanned within roles.json. For example:

// before
{
    "name": "Admin",
    "permissions": {
      "appointments": "read-write",
    }
}

// after
{
    "name": "Admin",
    "permissions": {
      "appointments": [
        "create",
        "update",
        "reschedule",
        "delete"
      ]
    }
}

This allows complex route-based actions like "rescheduling" to be represented as specific, named permissions in roles so that it's easy to see which users can do what. Note also here that create, update, and delete are also arbitrary and represent the maximum possible granularity. For endpoints that aren't as sensitive this could simply be edit, or even any - the meaning of the tokens is left up to the implementer and where/how they use them in the routes middleware.

Additionally for brevity the token all is introduced as a shortcut to allow all permissions:

// after
{
    "name": "Super Admin",
    "permissions": {
      "products": "all",
      "shops": "all",
      "users": "all"
    }
}

Middleware Shortcuts

The middleware also now allows shortcuts that make adding permission checks simpler:

// routes/invites.js
router
  .post('/',
    requirePermissions('users.invite'),
    async (ctx) => {
      // ..
    }
  )

The middleware functionality itself is the same, ie. it can be applied to each route or cascade with .use.

Multi-Tenancy

As multi-tenancy is often layered in after a project has gained maturity, a few tweaks were made to assume global scope out of the box. However this is also now more easily tweaked later:

// src/utils/middleware/permissions.js

// This can be changed to "organization" to quickly enable
// multi-tenancy. Be sure when doing this to lock down global
// permissions such as searching all users, impersonation, etc.
const DEFAULT_SCOPE = 'global';

Note that the grunt work of adding organization fields to each model, filtering searches by org etc remain the same. Streamlining that (if necessary) is left as out of scope for this PR.

Also note:

I need some input on the motivation behind permissions.json as that will need to be updated to fit in here.