Auth & Security · 05 Role-Based Access Control

Three roles, four routes, one map

Each cell is a real status code from go run ./demos/05. Fill the matrix one role at a time.

internal/authz/rbac.go

type Role string
type Perm string

const (
    RoleUser      Role = "user"
    RoleModerator Role = "moderator"
    RoleAdmin     Role = "admin"
)

const (
    ReadProfile Perm = "profile:read"
    DeletePost  Perm = "post:delete"
    ListUsers   Perm = "user:list"
    SetRole     Perm = "user:set_role"
)

var rolePerms = map[Role][]Perm{
    RoleUser:      {ReadProfile},
    RoleModerator: {ReadProfile, DeletePost},
    RoleAdmin:     {ReadProfile, DeletePost, ListUsers, SetRole},
}

func Can(r Role, p Perm) bool {
    for _, have := range rolePerms[r] {
        if have == p {
            return true
        }
    }
    return false // unknown role or perm: deny
}

→Routes ask for permissions, not roles. Adding a "support" role is one new map line — no route changes.

→Typed Role / Perm constants — a typo is a compile error, not a silent 403.

✓Default deny: anything not in the map — even a role called superuser — gets nothing.

The middleware that enforces it

It runs after RequireAuth, reads the role from the claims and answers 403 on its own.

internal/authz/middleware.go

func RequirePerm(p Perm, next http.Handler) http.Handler {
    fn := func(w http.ResponseWriter, r *http.Request) {
        c := auth.ClaimsFrom(r.Context())
        if c == nil || !Can(Role(c.Role), p) {
            http.Error(w, "forbidden", 403)
            return
        }
        next.ServeHTTP(w, r)
    }
    return http.HandlerFunc(fn)
}

// wiring: authenticate first, then authorize
protect := func(p Perm) http.Handler {
    return auth.RequireAuth(RequirePerm(p, h))
}
mux.Handle("GET /me", protect(ReadProfile))
mux.Handle("DELETE /posts/{id}", protect(DeletePost))
mux.Handle("GET /admin/users", protect(ListUsers))
mux.Handle("PATCH /admin/users/{id}/role", protect(SetRole))

go run ./demos/05 · one real JWT per role

            me   del  list role
(no token)  401  401  401  401
user        200  403  403  403
moderator   200  200  403  403
admin       200  200  200  200
superuser   403  403  403  403
# unknown role → denied everywhere

→Order matters: RequireAuth outside, RequirePerm inside — so no token is 401, wrong role is 403.

→The role lives in the JWT, so a demotion takes effect at the next refresh (≤ 15 min). Need it instant? Deny the jti (session 04).

→Hiding an admin button in the UI is not access control — the server check is.

Mistake

Letting users send their own role, e.g. {"role":"admin"} in the register body. Roles are only ever set by an admin endpoint guarded by SetRole.

TASK

Add a role without touching a route

Add RoleSupport that can ReadProfile and ListUsers.
Print the matrix again — only one new row should change.
Write a table-driven test that asserts every cell.

Three roles, four routes, one map

The middleware that enforces it

Add a role without touching a route

Session 05 in four lines