Recap — RBAC Patterns and Scopes

# RBAC Patterns and Scopes Authentication (who) is half the picture. Authorization (what can they do) is the other half. Most apps need some form of access control. ## Simple role-based ```python class User(Base): # ... existing fields ... role: Mapped[str] = mapped_column(default="user") # "user", "admin", "moderator" def require_role(required_role: str): def role_checker(current_user: User = Depends(get_current_user)): if current_user.role != required_role: raise HTTPException(403, f"Requires {required_role} role") return current_user return role_checker @app.delete("/users/{user_id}") def delete_user( user_id: int, admin: User = Depends(require_role("admin")), db: Session = Depends(get_db), ): ... ``` `require_role` is a factory that returns a dependency. Different roles = different dependencies. For multiple acceptable roles: ```python def require_any_role(*roles: str): def role_checker(current_user: User = Depends(get_current_user)): if current_user.role not in roles: raise HTTPException(403, "Insufficient permissions") return current_user return role_checker @app.post("/posts/{post_id}/moderate") def moderate( post_id: int, user: User = Depends(require_any_role("admin", "moderator")), ): ... ``` ## Permission-based (more flexible than roles) For finer-grained control: ```python class User(Base): permissions: Mapped[list[str]] = mapped_column(JSON, default=[]) def require_permission(perm: str): def checker(current_user: User = Depends(get_current_user)): if perm not in current_user.permissions: raise HTTPException(403, f"Missing permission: {perm}") return current_user return checker @app.delete("/posts/{post_id}") def delete_post( post_id: int, user: User = Depends(require_permission("delete_post")), ): ... ``` Or store permissions in a separate table for normalization. ## Resource-level authorization "Can user X edit post Y?" depends on whether user owns post: ```python def get_post_owned_by_user( post_id: int, current_user: User = Depends(get_current_user), db: Session = Depends(get_db), ) -> Post: post = db.get(Post, post_id) if not post: raise HTTPException(404, "Post not found") if post.author_id != current_user.id and current_user.role != "admin": raise HTTPException(403, "Not your post") return post @app.put("/posts/{post_id}") def update_post( post: Post = Depends(get_post_owned_by_user), payload: PostUpdate = Body(...), db: Session = Depends(get_db), ): post.title = payload.title db.commit() return post ``` Returns the post if owned (or admin); raises otherwise. ## OAuth2 scopes (advanced) For more flexibility, OAuth2 scopes allow per-token permissions: ```python from fastapi.security import OAuth2PasswordBearer, SecurityScopes oauth2_scheme = OAuth2PasswordBearer( tokenUrl="login", scopes={"users:read": "Read users", "users:write": "Modify users", "admin": "Admin access"}, ) def get_current_user( security_scopes: SecurityScopes, token: str = Depends(oauth2_scheme), ): payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM]) token_scopes = payload.get("scopes", []) for scope in security_scopes.scopes: if scope not in token_scopes: raise HTTPException(403, f"Missing scope: {scope}") return get_user_from_payload(payload) @app.get("/users", dependencies=[Security(get_current_user, scopes=["users:read"])]) def list_users(...): ... @app.delete("/users/{user_id}", dependencies=[Security(get_current_user, scopes=["users:write", "admin"])]) def delete_user(...): ... ``` OAuth2 scopes are great for: API keys with different permission sets; third-party access. ## Combine: roles + ownership The realistic pattern: ```python def can_edit_post(post: Post, user: User) -> bool: return post.author_id == user.id or user.role == "admin" @app.put("/posts/{post_id}") def update_post( post_id: int, payload: PostUpdate, current_user: User = Depends(get_current_user), db: Session = Depends(get_db), ): post = db.get(Post, post_id) if not post: raise HTTPException(404) if not can_edit_post(post, current_user): raise HTTPException(403) # update return post ``` Encapsulate the authz logic in a function; clear and testable. ## ABAC (attribute-based) For complex rules, use an authz framework (Casbin, OPA): ```python # Example policy: a user can edit a post if they're the owner OR if they're an editor of the post's team def can_edit(user, post): if post.author_id == user.id: return True if user in post.team.editors: return True return False ``` Complex policies grow; consider an external authz engine for serious apps. ## Audit logging Log all sensitive actions: ```python @app.delete("/users/{user_id}") def delete_user(