Wolkenkit: ACLs for authorization and user roles

Question

I am trying to understand on how to extend the wolkenkit auth layer.

Say i want users with different roles: normal, moderator and admin.

• normal users can see and modify their own content, but aren't allowed to modify content from other users.

• moderator users are allowed to modify all entries, but don't have permission to delete anything than their own content.

• admin users can modify and delete everything.

• There are also unauthenticated guest users who can read everything but modify nothing.

Reading the docs for Write model: Configuring authorization i can model the guest/normal use case by writing something along the lines of:

const initialState = {
  isAuthorized: {
    commands: {
      issue: { forAuthenticated: false, forPublic: false }
    },
    events: {
      issued: { forAuthenticated: true, forPublic: true }
    }
  }
};

For my requirements i would need additional roles defined in this object. Something like { forModerator: true, forAdmin: true }.

There is also Granting access from a command to change permissions at runtime, but i am not sure if that would work. Even if it does, that feels quite hacky.

Is this somehow possible?

Answer 1

Disclaimer: I am one of the developers of wolkenkit.

To cut a long story short: No, right now unfortunately this is not possible, but this feature is on our roadmap. At least today, I can't tell you when this will be available.

Your best option would be to do it on your own. One way to do this might be to use your identity provider to include a moderator claim in the JWTs of the moderators, and then handle this in the command handler appropriately.

In the command handler you have access to the token by

command.user.token

so you can get the claims as needed. I'm very sorry, that there is no better answer right now :-(