Add permission system

[m4tx]

We already have some simple auth, but we also need some sort of permission system that would allow checking if a user has sufficient permissions to access specific resources. The idea is probably something in the lines of check(user, object, action) pattern, but there are several open questions:

• How should we define actions and how much of this could be automated?
• How should we store the permissions in the database?
• Should we support some sort of groups (think "Moderators", "Admins", "Reviewers", etc.)? Should we support storing them (along with the permissions) in the database/hardcoded in the server binary/both?

[wheregmis]

Maybe using postgres with https://github.com/cmackenzie1/torii-rs ?

[ototech7]

hey @m4tx, this sounds like a great step forward. i’ve worked on auth and permission layers before, both RBAC and policy based ones, using postgres and serde configs. i’d like to help design or prototype the permission system here, maybe start with a simple check trait and later add group/role support and db storage.

[seqre]

I think we should approach it from the full AAA perspective (authentication, authorization, and accounting) and proper RBAC. Modern applications require good security and doing anything less could hurt the project in the long run.

Regarding the implementation, I'd go into solution baked into the framework rather some add-on checks to ensure proper coverage of routes, helping users design their roles and ensure what has to be protected is protected.