Authorization based on a list of user roles

[3141618]

Given a list of roles, I am trying to check if one of the roles is contained in the roles set. Can the wiki include an example?

user.ex schema

schema "users" do
  ...
  field :role, {:array, :string}
  ...
end

user_controller.ex

plug :role_check, [roles: ["admin", "superadmin"]] when action in [:index, :delete]

authorize.ex

def role_check(%Plug.Conn{assigns: %{current_user: nil}} = conn, _opts) do
  auth_error conn, "You need to log in to view this page", session_path(conn, :new)
end
def role_check(%Plug.Conn{assigns: %{current_user: current_user}} = conn, opts) do
  if opts[:roles] && current_user.role in opts[:roles], do: conn,
  else: auth_error conn, "You are not authorized to view this page", user_path(conn, :index)
end

[riverrun]

On the authorization page, there is an example of role_check. Do you think we should add anything to that example?

[3141618]

Yes. Based on my understanding, that approach works if the user's role is set to a string. However, it would allow for more flexibility to check a user's list of roles (an array or map of strings) against the opts[:roles] defined in user_controller.ex.

For example, the user_controller.ex could restrict :index and :delete actions to either admins or superadmins. If the user's roles contains either, they would be granted access to the :index and :delete actions.

In the section titled: More complex examples, id_or_admin/2 assumes current_user.role is a string. I am suggesting to include an example where current_user.role is an array or map of strings as this provides greater flexibility.

[3141618]

Hi David,

I figured out how to resolve a multi-role setup using maps instead of arrays. It's easier to use a map (or keyword list) instead of an array.

Thank you for developing Phauxth. You did a very good job.

[riverrun]

In your case, does each user have more than one role? When I wrote the example, I was thinking of each user just having one role, but I suppose it's possible for them to have multiple roles.

If you have any examples that you think will be useful for the wiki, just let me know.

[3141618]

Yes, multiple roles with potentially multiple permission sets. My implementation is somewhat similar to https://github.com/riverrun/phauxth/pull/32