implement basic role-based access control with auth0

Author: byron-okta

README.md

@@ -1,10 +1,10 @@
-# Rails/Ruby: API Basic Access Control Code Sample
+# Rails/Ruby: API Basic Role-Based Access Control (RBAC) Code Sample
 
-This Ruby code sample demonstrates **how to implement authorization** in Rails API servers using Auth0.
+This Ruby code sample demonstrates **how to implement Role-Based Access Control (RBAC)** in Rails API servers using Auth0.
 
 This code sample is part of the ["Auth0 Developer Resources"](https://developer.auth0.com/resources), a place where you can explore the authentication and authorization features of the Auth0 Identity Platform.
 
-Visit the ["Rails/Ruby Code Sample: Authorization For Basic APIs"](https://developer.auth0.com/resources/code-samples/api/rails/basic-authorization) page for instructions on how to configure and run this code sample and how to integrate it with a Single-Page Application (SPA) of your choice.
+Visit the ["Rails/Ruby Code Sample: Role-Based Access Control For Basic APIs"](https://developer.auth0.com/resources/code-samples/api/rails/basic-role-based-access-control) page for instructions on how to configure and run this code sample and how to integrate it with a Single-Page Application (SPA) of your choice.
 
 ## Why Use Auth0?
 

app/controllers/api/messages_controller.rb

@@ -5,7 +5,9 @@ class MessagesController < BaseController
     before_action :authorize, except: [:public]
 
     def admin
-      render json: Message.admin_message
+      validate_permissions ['read:admin-messages'] do
+        render json: Message.admin_message
+      end
     end
 
     def protected

app/controllers/concerns/secured.rb

@@ -12,6 +12,11 @@ module Secured
     error_description: 'Authorization header value must follow this format: Bearer access-token',
     message: 'Bad credentials'
   }.freeze
+  INSUFFICIENT_PERMISSIONS = {
+    error: 'insufficient_permissions',
+    error_description: 'The access token does not contain the required permissions',
+    message: 'Permission denied'
+  }.freeze
 
   def authorize
     token = token_from_request
@@ -20,9 +25,18 @@ def authorize
 
     validation_response = Auth0Client.validate_token(token)
 
+    @decoded_token = validation_response.decoded_token
+
     return unless (error = validation_response.error)
 
-    render json: {message: error.message}, status: error.status
+    render json: { message: error.message }, status: error.status
+  end
+
+  def validate_permissions(permissions)
+    raise 'validate_permissions needs to be called with a block' unless block_given?
+    return yield if @decoded_token.validate_permissions(permissions)
+
+    render json: INSUFFICIENT_PERMISSIONS, status: :forbidden
   end
 
   private

app/lib/auth0_client.rb

@@ -8,6 +8,13 @@ class Auth0Client
   # Auth0 Client Objects
   Error = Struct.new(:message, :status)
   Response = Struct.new(:decoded_token, :error)
+  Token = Struct.new(:token) do
+    def validate_permissions(permissions)
+      required_permissions = Set.new permissions
+      token_permissions = Set.new token[0]['permissions']
+      required_permissions <= token_permissions
+    end
+  end
 
   # Helper Functions
   def self.domain_url
@@ -43,7 +50,7 @@ def self.validate_token(token)
 
     decoded_token = decode_token(token, jwks_hash)
 
-    Response.new(decoded_token, nil)
+    Response.new(Token.new(decoded_token), nil)
   rescue JWT::VerificationError, JWT::DecodeError => e
     error = Error.new('Bad credentials', :unauthorized)
     Response.new(nil, error)