libreconnect / backend

MIT License
12 stars 0 forks source link

Implement Authorization for Company Creation using Keycloak #8

Closed NathaelB closed 3 months ago

NathaelB commented 3 months ago

This pull request implements authorization checks for the creation of companies within our application using Keycloak. The main goal is to ensure that only users with the necessary permissions can create new company records. The implementation includes the following.

  1. Keycloak Configuration
    • A new permission named create_company has been defined in Keycloak.
    • This permission has been assigned to relevant roles such as admin and superuser
  2. Policy Creation and Application
    • A policy has been created to ensure that the user has the necessary authorization to perform the action of creating a company.
    • This policy has been applied to the company creation endpoint in our application.
  3. Testing
    • Tests have been written to verify that unauthorized users receive a 403 Forbidden response when attempting to create a company.
    • Additional tests ensure that authorized users with the appropriate permissions can successfully create a company and receive a 201 Created response.
    • Tests also check for the correct error handling, ensuring that users without a valid JWT receive a 401 Unauthorized response.