ETA for RBAC? It's available in V1 but not V2?

[irab]

There's docs and support for roles and access control in V1 but not in v2?

With no middleware in V2 there's not a clear way to implement a rbac resource guard as discussed here?
https://docs.medusajs.com/v1/modules/users/backend/rbac

[erickirt]

Check out the delivery example to see how different roles are implemented

[irab]

I have a question: is it possible to override the jwt token or add a custom attribute to the token?

I'd like to add the permissions directly in the token to optimize the middleware and avoid a call to the backend.

Thanks

JWT tokens are signed and designed to be tamper resistant:

https://datatracker.ietf.org/doc/html/rfc7519

[0x4res]

Yes, the best practice is to implement a claim into the jwt token with the permission of the user because the token is signed by the server.
For example, like this.

{
  "actor_id": "user_01JFF0T6B9PPHREHG6SKBZ",
  "actor_type": "user",
  "auth_identity_id": "authid_01JFF0T6AC0KTT4Q4TCAXT4E08",
  "app_metadata": {
    "user_id": "user_01JFF0T6B9PPHREHG6SKBZD1ZT"
    "role":[
              {"/product/*": "READ"},
              {"/rbac/*": "WRITE"},
              {"/user/*": "READ"},
    ]
  },
  "iat": 1740381456,
  "exp": 1740467856
}

[SalahAdDin]

Yes, the best practice is to implement a claim into the jwt token with the permission of the user because the token is signed by the server. For example, like this.

{
  "actor_id": "user_01JFF0T6B9PPHREHG6SKBZ",
  "actor_type": "user",
  "auth_identity_id": "authid_01JFF0T6AC0KTT4Q4TCAXT4E08",
  "app_metadata": {
    "user_id": "user_01JFF0T6B9PPHREHG6SKBZD1ZT"
    "role":[
              {"/product/*": "READ"},
              {"/rbac/*": "WRITE"},
              {"/user/*": "READ"},
    ]
  },
  "iat": 1740381456,
  "exp": 1740467856
}

How is it used on the Admin?

Can we have an architecture like Strapi? with custom hooks and etc.?

[0x4res]

I don’t I search how make this with the emailpass provider but the Token generator of medusja don’t provide this feature
Maybe I do a auth provider

[SalahAdDin]

Is it for Entreprise only?