Skip to main content

Role Based Access Control

Warrant provides out-of-the-box support for implementing Role Based Access Control (RBAC) using the built-in user, role, and permission object types.

Users, roles, and permissions can be created and managed from the Warrant Dashboard or via the API. This quickstart will walk you through setting up your roles & permissions and adding permissions checks to your application.

1. Create Your Users in Warrant

The first step is to make sure new users in your application are created in Warrant so they can be assigned roles and permissions. To do this, add the following code to your application's sign-up and login flows:

// 1. Your application's sign-up / login logic

// 2. Create user in Warrant
warrantClient
.createUser(user.email, user.id)
.then((warrantUser) => console.log(warrantUser))
.catch((error) => console.log(error));

// 3. Finish sign-up / login logic

2. Creating Permissions

Next, we'll create our application's permissions in Warrant. You can create permissions once manually (if the set of permissions for your application is finite) and/or programmatically from your application code using the Warrant SDK. To create a permission you need to provide it a unique string identifier:

warrantClient.createPermission("view-dashboards");
warrantClient.createPermission("create-dashboards");
warrantClient.createPermission("edit-dashboards");
warrantClient.createPermission("delete-dashboards");

3. Creating Roles

Next, we'll create our application's roles. Ideally, the set of roles within an application should be finite and is usually well-defined upfront and so roles should only have to be created once (or infrequently). Like permissions, to create a role you need to provide it a unique string identifier:

warrantClient.createRole("admin");
warrantClient.createRole("basic");

4. Assigning Permissions to Roles

The roles we created aren't useful until we assign permissions to them. Let's assign the view-dashboards permission to the basic role and all four permissions to the admin role.

warrantClient.assignPermissionToRole("basic", "view-dashboards");

warrantClient.assignPermissionToRole("admin", "view-dashboards");
warrantClient.assignPermissionToRole("admin", "create-dashboards");
warrantClient.assignPermissionToRole("admin", "edit-dashboards");
warrantClient.assignPermissionToRole("admin", "delete-dashboards");

5. Assigning Roles to Users

Now that our roles are assigned permissions, we can assign them to users. Users can be assigned multiple roles. Let's create two users and assign each of them one of the roles we created.

const adminUser = warrantClient.createUser("admin.user@my-customer.com");
const basicUser = warrantClient.createUser("basic.user@my-customer.com");

warrantClient.assignRoleToUser(adminUser.userId, "admin");
warrantClient.assignRoleToUser(basicUser.userId, "basic");

6. Assigning Permissions to Users

Permissions can also be directly assigned to users. Let's assign edit-dashboards to a user.

warrantClient.assignPermissionToUser(basicUser.userId, "edit-dashboards");

7. Checking for Permissions

Once our roles and permissions are defined and assigned amongst users, we can start to check permissions on specific users as such:

// Returns true
warrantClient.hasPermission("delete-dashboards", adminUser.userId);

// Returns false
warrantClient.hasPermission("delete-dashboards", basicUser.userId);

Self Service Permissions Management

Following this quickstart guide, you should be able to setup RBAC for your application. Particularly for B2B applications, as your application continues to mature, your customers might ask you for the ability to manage their team's roles and permissions themselves.

The Warrant Self Service Dashboard is a Warrant-hosted page you can embed into your application to allow your users to manage their own organization's roles and permissions. See the Self Service Permissions Management guide for more details.