RBAC

[edobrb]

Work in progress...

---

Specification for RBAC support

---

Terminology

Role
A role is just a tag. For example ADMIN. A client can have a set of roles attached to some specific domains
Example:

// Is an Admin for the tenant 1 and a maintainer for tenant 2
[
  { role: 'ADMIN', domain: { tenantId: 1 } },
  { role: 'MAINTAINER', domain: { tenantId: 2 } },
]

Domain
A domain is defined as a category to which an entity belongs.

Operation domain
The current operation domain.
Example:

//The operation domain is { tenantId: 2 }
sdk.updateTenant({ id: 2, name: "MyTenant" })

Permission
A permission is a specification fo what some role can do

true | { read: Projection, write: boolean, delete: boolean }

Every Mondrian type can have a map of role -> permission
Example:

{
  Tenant: {
    ADMIN: true, //can do anything
    MAINTAINER: { //can read and write but not delete
      read: true,
      write: false
      delete: false
    }
  },
  User: {
    ADMIN: true //can do anything
    MAINTAINER: { //can only read name
      read: {
        name: true
      }
    }
  }
}

Operation type
read, write or delete

---

Goal
Before calling a function we must understand if with the given input and context the client can perform the action:

(
  client's roles, 
  types permissions, 
  this operation domain,
  this operation types,
  requested projection
) -> yes / no+reason