[Authorization] Figure out how to authorize users

[alexlemaire]

admin.auth.getSignedUrl
scope structure = group name/structure

[Holger-Will]

well, maybe it's easier to handle the scopes ourselves...
in our database, we should have a "User" Index holding the Users information (they are matched to Cognito by their e-mail).

in these "User"-Docs we store the scope a user has access to as an array of strings.
after successful authentication, we fetch this info from the DB and store these in a session store like Redis (AWS ElastiCache supports Redis i think)
per lambda we can then have a const describing the scope of that function. we then have a simple matcher module with the logic for matching use scopes with function scopes... this module would live in a layer that we attach to all our lambdas...

[Holger-Will]

this is how it could work:

const color = require('@kaskadi/better-colors')
const user1 = {
  name: 'User 1',
  scopes: ['erp.products.view']
}
const user2 = {
  name: 'User 2',
  scopes: ['erp.products.add', 'erp.products.view', 'erp.products.edit']
}
const user3 = {
  name: 'User 3',
  scopes: [ 'erp.products']
}
const admin = {
  name: 'Admin',
  scopes: ['erp']
}
scopes = ['erp.products.view', 'erp.products.add', 'erp.products.delete', 'erp.documents']
users = [user1, user2, admin]

function hasAccess (user, func) {
  let fa = func.split('.')
  for (var i = 0; i < fa.length + 2; i++) {
    if (user.scopes.includes(fa.join('.'))) {
      return true
    }
    fa.pop()
  }
  return false
}

users.forEach(user => {
  scopes.forEach(scope => {
    console.log(`${user.name}: ${hasAccess(user, scope) ? color('green') : color('red')} ${scope} ${color.RESET}`)
  })
})

[alexlemaire]

Sounds good to me! 👍