Role-Based Access Control (RBAC)

# CHAPTER 9

Role-Based Access Control (RBAC) #

1. Introduction #

2. Learning Objectives #

• Define the principles of Role-Based Access Control (RBAC).

• Distinguish between Users, Roles, and Permissions.

• Design database architectures to support RBAC (Many-to-Many relationships).

• Implement an Authorization middleware function in Node.js/Express.

• Enforce granular access control on API routes.

3. Beginner-Friendly Explanation #

• The User: Dr. Smith, Nurse Jones, and Janitor Bob.

• The Permissions: "Prescribe Medicine," "View Patient Records," "Clean Operating Room."

• The Role: We create a "Doctor" Role and attach the "Prescribe Medicine" and "View Patient Records" permissions to it.

4. The RBAC Database Architecture #

You need three primary tables:

1. 1. Users Table: Contains the user's email and password.

1. 2. Roles Table: Contains the roles (e.g., Admin, Editor, Viewer).

1. 3. UserRoles Table (Pivot/Junction Table): Links a specific User ID to a specific Role ID.

*Advanced Implementations:* Large enterprises add a fourth and fifth table: Permissions Table (e.g., deletepost) and a Role_Permissions Pivot Table to link specific actions to specific roles.

5. Simple Implementation: The Role Column #

-- A simplified Users table for small applications
CREATE TABLE users (
    id INT PRIMARY KEY,
    email VARCHAR(255),
    role VARCHAR(50) DEFAULT 'user' -- Possible values: 'user', 'editor', 'admin'
);

6. Passing the Role in the JWT #

// During the login process...
const payload = {
    userId: user.id,
    role: user.role // e.g., "admin"
};
const token = jwt.sign(payload, SECRET_KEY);

7. Building the Authorization Middleware (AuthZ) #

// THE AUTHORIZATION MIDDLEWARE
// This function accepts an array of allowed roles
function authorizeRoles(...allowedRoles) {
    // It returns a standard Express middleware function
    return (req, res, next) => {
        // req.user was populated by the authenticateToken middleware!
        const userRole = req.user.role;

        // Check if the user's role is in the list of allowed roles
        if (!allowedRoles.includes(userRole)) {
            return res.status(403).json({ 
                error: "Forbidden. You do not have permission to access this resource." 
            });
        }
        
        // Success! They have the correct role.
        next();
    };
}

8. Protecting Routes with RBAC #

// Only Admins can delete users
app.delete('/api/users/:id', 
    authenticateToken, 
    authorizeRoles('admin'), 
    (req, res) => {
        // Execute deletion logic...
        res.json({ message: "User deleted." });
});

// Both Admins AND Editors can publish posts
app.post('/api/posts', 
    authenticateToken, 
    authorizeRoles('admin', 'editor'), 
    (req, res) => {
        // Execute publish logic...
        res.json({ message: "Post published." });
});

// Standard users (and above) can view their profile
app.get('/api/profile', 
    authenticateToken, 
    authorizeRoles('admin', 'editor', 'user'), 
    (req, res) => {
        res.json({ message: "Viewing profile." });
});

9. Backend Workflow: Dynamic Permissions (ABAC) #

• Challenge: Look at the authorizeRoles factory function. Rewrite this conceptual logic in pure PHP. Write a function checkrole($requiredrole) that checks a hypothetical $SESSION['role'] variable. If it does not match, use header("HTTP/1.1 403 Forbidden"); and exit().

14. MCQs with Answers #

15. Interview Questions #

• Q: Differentiate between Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC). Provide a specific scenario where RBAC is insufficient and ABAC must be utilized.

• Q: Explain the design pattern of creating Authorization Middleware factory functions (like authorizeRoles('admin', 'editor')) in Express.js. Why is this preferable to hardcoding if (req.user.role !== 'admin') inside every single route handler?

16. FAQs #

17. Summary #

18. Next Chapter Recommendation #