Need some help in the desing of the Auth/Permissions of a REST API for a SAAS app.
I'd done a prototype of a SAAS app and for permissions of the SAAS client, I'd setup the API to request for a header called
CLIENT-ID. This way, the API filters all views by the Logged in Client. This header is Mandatory.
The next thing am testing is building the
Super Admin Backend and am thinking the best way is to use the same APIs but then have the appropriate permission checks.
Now, the super-admin should be able to "work on multiple clients" e.g. when they do a
GET request for
/clients, they should be able to see a list of all clients as opposed to a Client Admin who would only see their client coz the
CLIENT-ID header would filter to ensure the view returns the correct results. To allow the Super Admin to do this then I have to make the
CLIENT-ID header non-mandatory for their role?
So my issue is, how do I provide a consistent API to provide for both types of roles?
For each API, I have to check the role of the user, if its a Super Admin role then I skip enforcing the
CLIENT-ID header. That's doable. Issue though is, if the Super Admin then wants to get a single client, then I now have to request them to provide the CLIENT-ID header or I have to introduce it as a filter parameter. My problem here is now I have extra scenarios to check and am thinking I haven't even thought through all possible scenarios.
Create different REST views for the admin. This however then duplicates tons of code and its not pretty.
So am gravitating towards option 1 but it seems to get complex with each different scenario. Or is there no alternative and I just have to bake in this scenarios?
Am building the APIs using Django Rest Framework so any framework specific pointers would be welcome also.