Configurable option of Authorization (roles and permissions) for each route

[jeevatkm]

The goal is to bring configurable option of Authorization at domain and route level for roles and permission.

How is authorization (Roles and Permission) check happening now?

Currently, aah user have to use Controller interceptors (Before or Before<Action> based on scenario) to do roles and permission check.

What are the benefits of having this configurable option at each route level?

• aah performs the Authorization per configured roles and permission against logged in Subject for incoming request
  • If authorization is success then request would proceed as normal
  • If authorization is failed then aah calls error handling flow
  • If authorization check is not configured then request would proceed to controller action
• Also you have existing flexibility and control to do you own Authorization

Configuration Syntax

# Authorization (access rights/privileges)
# 
# Note: It is not evaluated, if `<route>.auth` attribute is `anonymous`.
authorization {
  # Satisfy value is used to evaluate the result of `roles` and `permissions` attribute.
  #
  # Possible values are 
  #   - `either` => either roles or permissions should satisfy for Subject
  #   - `both`   => both roles and permissions should satisfy for Subject
  #
  # Default value is `either`.
  satisfy = "either"

  # Roles (Optional config)
  # Result of role function is evaluated as AND.
  #
  # Supported functions are `hasrole`, `hasanyrole`, `hasallroles`.
  # Roles are comma(,) separated values.
  roles = [
    "hasrole(manager)",
    "hasanyrole(role1, role2, role3)"
  ]

  # Permissions (Optional config)
  # Doc: https://docs.aahframework.org/security-permissions.html
  #
  # Result of permission function is evaluated as AND.
  #
  # Supported functions are `ispermitted`, `ispermittedall`.
  # Permissions are pipe(|) separated values.
  permissions = [
    "ispermitted(newsletter:read,write)",
    "ispermittedall(newsletter:read,write | newsletter:12345)"
  ]
}

Where to configure Authorization ?

Authorization configuration defined in routes.conf.

• Child Route inherits parent authorization { ... } config if not defined.

---

• Implementation
• Documentation

[jeevatkm]

All - You're invited to discuss this spec before implementation 😄

[jeevatkm]

Its done 😄