Implement Role-Based Access Control for Backend API

[ratnesh-maurya]

Description:

We need to implement role-based access control (RBAC) for our backend API. Currently, the API does not enforce permission checks based on user roles. Each API endpoint should verify the user's role (obtained from the bearer token) and execute the endpoint only if the user has the appropriate permissions.

Implementation Reference:

The following code snippet demonstrates the desired role checking mechanism:

        role, _ := c.Get("role")

        if role != "superadmin" && role != "admin" && role != "user" {
            c.JSON(http.StatusUnauthorized, gin.H{
                "status":  http.StatusUnauthorized,
                "message": "Unauthorized ",
                "data":    nil,
            })
            return
        }

Objectives:

1. Role Extraction: Extract the user role from the bearer token in the context.
2. Permission Checks: Implement checks in each API endpoint to verify if the user has the required role(s) to execute the operation.
3. Error Handling: Return appropriate HTTP status codes and messages if the user is unauthorized.
4. Testing: Ensure that the new role checks are thoroughly tested for all API endpoints.

Requirements:

• Update all existing API endpoints to include role checks.
• Ensure the functionality aligns with security standards.
• Maintain clear and concise error messages for unauthorized access.

Acceptance Criteria:

• All API endpoints implement role-based access control.
• Users receive appropriate responses based on their permissions.
• Documentation is updated to reflect changes in API behavior.

[Charul00]

can you please assign to me i am interested in this

[ratnesh-maurya]

I have assigned one task to you once you finish that then i can assign you this issue Thanks

[yasheela-alla]

Hi @ratnesh-maurya sir! could you Please assign this issue to me

[ratnesh-maurya]

sure , go ahead

[ratnesh-maurya]

@yasheela-alla what .env variables you are using i think the error which you mention was due to "SALT" use this as the env variables

SALT = "E_SALA_CUP_NAMDE"

[yasheela-alla]

still seeing the error 404

[ratnesh-maurya]

48