I will try to explain my problem by using a familiar application. Lets'say I'm building a Discord / Slack / Microsoft Teams clone; and for simplicity’s sake, it will contain 2 services:
- Must sign in to use the application
- Once signed in, he/she can either join a group or create a group
- Can be part of multiple groups
Group: A place where multiple users can chat
- Users can either be a
- Users can either be a
When the user sign's in it will be given a JWT token to authenticate requests future request.
Not every user has the same permissions, some are
members others are
moderators. In other words, some users must be forbidden access from specific functionality/API endpoints.
As example, a member is not allowed to invite people to a group, only moderators are allowed to do that.
Upon sign in the user will get a JWT token with some information inside. This information excludes the permission list per group, since the permissions of all users are stored inside the group service.
This means that, upon sign in, the user is missing an authorization/permissions token while having an authentication token.
I don't want to create a dependency between the 2 services by requesting upon sign in (from the user service) the permission list (from the group service).
When & where should I grab and assign the permission list?
Currently, I have 2, probably not so great, options that I'm considering. Assuming that requesting the permission list upon sign in isn't possible (because that would create a dependency).
Create an API endpoint that generates the JWT token containing the permission list.
- This imitates the user sign in functionality where also a token is granted by calling an endpoint.
- The problem is that this would expose the internal functionality & would assume that the front-end developer knows about this
really not so nicefeature
Use middleware to generate the JWT token containing the permission list when no token is found.
- I'm currently using middleware to validate the presence of the JWT token.
- I'm not quite sure if it's considered good design when you do database calls & stuff inside middleware; but I'm not sure. Never done it before
Also, adding the permission list to the
user service is not possible. The permissions depend on every single group.
A user can be a
memberof one group while being a
moderatorinside another group.