Implement RBAC using Tesseral

Sign up for Tesseral

If you haven’t already, sign up for Tesseral at console.tesseral.com and follow the Quickstart Guide.

Define Actions

Go to your Project’s Access Control settings. You will now define a set of Actions. Each Action represents a single conceptual operation your Users can perform in your app. Actions have a name and a description.

An Action’s name is the unique identifier for the Action. Later, when you add permission checks to your backend, you will reference the Action by its name.

An Action’s description is a human-readable description of the Action. It will be displayed to your Users to explain what the Action does.

You can create as many Actions as you want, and you can add more Actions later as your app develops further.

By way of example, your set of Actions might look like:

Define Roles

Once you have defined Actions, you can define Roles. A Role is a set of Actions, and Users can be assigned to Roles. Users can be assigned to multiple Roles.

In the previous step, you defined Actions. Each Action represents a fine-grained operation Now, you will define Roles. A Role is a set of Actions.

To define a new Role, click on “Create Role” at the top right of the “Roles” section. Give each Role a User-facing Display Name, then add Actions to the Role. You can add as many Actions as you want.

Using the same example from the previous step, you might define the following Roles:

Assign Users to Roles

Once you have defined Roles, you can assign Users to Roles. You can assign as many Users as you want to a Role, and you can assign a User to multiple Roles.

Your customers can assign their own Users to Roles, or you can assign Users to Roles yourself from the Tesseral Console.

To assign a User to a Role from the Tesseral Console, go to the Organizations page in the Tesseral Console. Find the User’s Organization and then navigate to the User’s Role tab.

From this User Roles tab, you can assign or unassign the User to or from Roles.

Add permission checks to your backend

Now that you’ve defined Roles and Users, you can add permission checks to your backend. Use the Tesseral SDK for your backend language to enforce permission checks in your product.

1
import { hasPermission } from "@tesseral/tesseral-express";
2
3
app.get("/api/widgets/delete", (req, res) => {
4
  if (!hasPermission(req, "acme.widgets.delete")) {
5
      // ...
6
  }
7
  // ...
8
});

(Optional) Add permission checks to your frontend

Adding permission checks to your frontend is optional. If you don’t want to enforce permissions in your frontend, you can skip this step. The advantage of adding permission checks to your frontend is that you can display a more user-friendly error message to your Users if they are not allowed to perform an action.

You can add permission checks to your frontend using the Tesseral SDK for your frontend language.

1
import { useHasPermission } from "@tesseral/tesseral-react";
2
3
const DeleteWidgetsButton = () => {
4
  const hasPermission = useHasPermission();
5
6
  return (
7
    <Button 
8
      disabled={!hasPermission("acme.widgets.delete")}
9
    >
10
      Delete Widget
11
    </Button>
12
  );
13
}