When building API-driven SPAs, I'm wondering what the best practice is regarding communicating to the frontend app about which actions are permitted for the currently logged-in user.
Assume there is an RBAC system implemented on the backend. Depending on the policies attached to the current user's role, they may or may not have the ability to perform certain operations. Moreover, we would like to control which buttons/options are visible to the user based on their role.
Thus far, I've implemented a design where as part of the GET response of the resource in question, I'd include a list of actions that the user can perform against the resource. There would also be API-level authorization implemented for each of those actions as well to ensure integrity.
But I am also noticing that as the resources and the application, in general, are growing in complexity, the code to generate the 'abilities' list is growing as well.
Essentially, curious whether this is the standard approach or are there more scalable/cleaner ways to implement this.
