I'm building an API that will be used by the front-end in React and I'm not quite sure how I should send the permissions of each user based on their roles. Some fields can only be edited in some states and by a defined role. It is quite complex and I really don't know how I'll send that information, everything I know is that they think that it is a bad idea to have those fields and permissions hardcoded in the front-end.

  "requests": {
    "occurrences": {
      "create": {
        "gestor": ["requestTypeId", "claimantName", "claimantEmail", "claimantPhone", "claimantAddress", "claimantDoor", "claimantLocation", "claimantPostal", "description", "address", "location", "postalCode", "methodId", "originId", "tagId", "possibleSolution", "expectedStart", "expectedDuration", "priorityId", "userId", "competenceId"],
        "secretaria": ["requestTypeId", "claimantName", "claimantEmail", "claimantPhone", "claimantAddress", "claimantDoor", "claimantLocation", "claimantPostal", "description", "address", "location", "postalCode", "methodId", "originId", "tagId"]
      "edit": {
        "submetido": {
          "gestor": [],
          "secretaria": []
        "pendente": {
          "gestor": []

I thought about the structure above with the fields that are needed to create a request or what fields can be changed in what state and by what role but that looks very verbose so I'm not sure if that's the best approach.

  • Why don't you just send the roles or ACLs to the front-end, and leave the front-end to handle its own access control? Segregate concerns, back-end and front-end are different applications.
    – Laiv
    May 9 '19 at 15:11
  • They already have access to the roles and I'm already doing RBAC but everything they are doing, in the different states, is hardcoded and I was told by them that it isn't the ideal and that I should send them the permissions for each role/state/request. We are all junior developers so there's a good chance we are lost.
    – André
    May 9 '19 at 15:18
  • Looks like you have to sit with whoever is telling you to do this and make some questions. Sounds to me like "they" have something in mind but they didn't success on letting you know what it's. Perhaps, it's something simpler than you think.
    – Laiv
    May 9 '19 at 15:26
  • I had a talk with the person that asked me to do this and everything that was told to me is that it would be better if they knew what each role could do in a determined state based on a permissions list they could get when logged in since if something had to change (e.g. a said role can no longer edit a value), I would just have to change it on the "configuration" that is being sent. That person sent me this as examples - snippi.com/s/6e99xdc - with "Gestor" and "Secretária" being roles.
    – André
    May 9 '19 at 15:37
  • The model suggested by the link is fairly different (and simpler I dare to say) than the one you have introduced in your question. Have you tried to do it as in the link?
    – Laiv
    May 9 '19 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.