Open raayu83 opened 2 months ago
Thanks for taking the time to write up these requirements. I've been developing a authorization system for reflex that addresses most of these concerns, but I do have a question about the permission model.
In my prototype, permissions are a binary: either the user/group has the permission set as "allow" or "deny" (with deny taking precedence). To me this seemed easier to implement and more flexible than a multi-state permission system.
I'll share my prototype in the next week or so for review/critique.
Hi @masenf ,
this sounds very interesting!
By binary permissions you mean that you don't differentiate between view/change/add/delete? Looking at the kind of projects I've been doing recently, this would be a very important feature.
By binary permissions you mean that you don't differentiate between view/change/add/delete?
That's correct. So if I had some kind of object, like a Post
, i might define permissions like the following
Post_view
Post_create
Post_change
Post_delete
These permissions would then be assigned to users or groups with ALLOW
or DENY
.
In my opinion, this seems to give the developer the most flexibility to define their permissions as needed for the given application.
This seems fine to me 👍
Maybe we could somehow integrate reflex States into an Authorization System. Currently, every user can access all State vars and all event handlers. IMO, a Model based permission system has not much to do with reflex, because reflex (unlike django f.e.) doesn't have auto-generated admin model pages. I still don't quite understand what the model-based "Authorization System" proposed in this Issue should do. The only useful thing I could image is providing a protected/scoped sqlalchemy/sqlmodel session. But that could be a separate project outside of reflex as well.
As mentioned in the initial post, my experience with permissions stems from Django and might be a bit dated (and not suited for reflex). I'd be open for anything that solves permission handling in a good way.
I'm also interested in this topic for a project I'm working on and I'm very open to suggestions. Our use case has different accessibility for the objects:
On top of that for each resource we have permissions:
read-all
read-group
read-mine
create (with owner and group ids)
update-all
update-group
update-mine
delete-all
delete-group
delete-mine
assign/revoke permissions
Is casbin
https://casbin.org/ a better solution which can address varying needs?
Can you please add Okta Authentication like Google oAuth ?
https://developer.okta.com/code/
Python SDK : https://github.com/okta/okta-sdk-python. Example : https://github.com/okta/samples-python-flask
React SDK : https://github.com/okta/okta-react Example : https://github.com/okta-samples/okta-react-sample
Hi @Alek99,
as discussed in Discord, I'm writing down some ideas about an Authorization system (as opposed to Authentication System, though I'd love to see a standards based pluggable integration there too).
Personally, I'd be happy with something along the lines of Django, including the Django Admin section that provides a User Interface for administration of the permissions. I don't have any experience with more recent tooling in this aspect, so what I'm going to write might be a bit outdated and should be taken with a grain of salt.
For this kind of Authorization, there are mainly the following Models needed:
As far as applying the permissions is concerned... I think for Models that have a permission assigned it would be great if corresponding permissions would be checked automatically when doing operation on the models (with an option to override). As for how to do that, I'm unsure. As a foundation, it might be worth using exceptions. However catching exceptions every time you try to save an object seems like a hassle. I wonder if it is possible to add some abstraction layer on top of permission exceptions that allows to handle this more globally and automatically show nicely formatted errors in the User interface....
Additionally, it would love if there was an Row based Authorization system, but I don't know enough about these to write here.