Skip to content

feat: Implement Role-Based Access Control (RBAC) - Closes #70#97

Open
ThrustSoftwares wants to merge 3 commits intobos-com:mainfrom
ThrustSoftwares:feat/rbac-implementation
Open

feat: Implement Role-Based Access Control (RBAC) - Closes #70#97
ThrustSoftwares wants to merge 3 commits intobos-com:mainfrom
ThrustSoftwares:feat/rbac-implementation

Conversation

@ThrustSoftwares
Copy link
Copy Markdown

Summary
This PR implements Role-Based Access Control (RBAC) for the LifeLine-ICT backend
to enhance security and permission management.

Changes

  • Added Role model with enum roles (Admin, Moderator, User)
  • Updated User model with role_id foreign key
  • Created RBAC security utilities and decorators
  • Protected delete endpoints with admin-only checks
  • Added database migration for roles table
  • Added unit tests for RBAC functionality

Requirements from Issue #70

  • Define User Roles (Admin, Moderator, User)
  • Implement middleware/decorators for permission checks
  • Update database schema with role relationships
  • Return 403 Forbidden for unauthorized access
  • Restrict admin endpoints to Admin role

Testing

  • Run pytest backend/tests/test_rbac.py to verify
  • Manual testing: Try accessing DELETE endpoints as regular user (should fail)

Related to Issue #70

Closes #70

Standardize PR Contributions
- Add Role model with RBAC roles (Admin, Moderator, User)
- Update User model to include role_id foreign key
- Create RBAC security utilities and decorators
- Add role-based access checks to delete endpoints
- Add database migration for roles table
- Add initial RBAC tests
- Refs bos-com#70
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Implement role-based access control (RBAC) #35 Open Feature

1 participant