feat: rbac system

[botprzemek]

Description

Create RBAC system with FastAPI and Cloudflare Workers - decide where to use D1 Database and KV storage (faster read from KV).

Users should have permissions based on RESOURCE:PERMISSION - the most important route is access-check, that would be requested from Marketing API to verify if user has permission to resource e.g. COMPANIES:CREATE or LISTS:READ

Database Schema

Refer to file migrations/0001_seed.sql

API Schema

GET /roles

Response:

[
  {
    "id": 1,
    "name": "admin",
    "description": "System administrator",
    "permissions": ["user:create", "user:delete"]
  }
]

POST /roles

Request:

{
  "name": "editor",
  "description": "Can edit and publish content"
}

Response:

{
  "id": 2,
  "name": "editor",
  "description": "Can edit and publish content"
}

PUT /roles/{id}

Request:

{
  "description": "Editor with limited access"
}

Response:

{
  "id": 2,
  "name": "editor",
  "description": "Editor with limited access"
}

DELETE /roles/{id}

Response:

{ "message": "Role deleted successfully" }

GET /permissions

Response:

[
  {
    "id": 1,
    "name": "user:create",
    "description": "Create a new user"
  }
]

POST /permissions

Request:

{
  "name": "article:publish",
  "description": "Publish an article"
}

Response:

{
  "id": 5,
  "name": "article:publish",
  "description": "Publish an article"
}

PUT /permissions/{id}

Request:

{ "description": "Publish articles to public feed" }

Response:

{
  "id": 5,
  "name": "article:publish",
  "description": "Publish articles to public feed"
}

DELETE /permissions/{id}

Response:

{ "message": "Permission deleted successfully" }

POST /roles/{role_id}/permissions

Request:

{
  "permission_ids": [1, 2, 3]
}

Response:

{
  "role_id": 1,
  "assigned_permissions": [1, 2, 3]
}

GET /roles/{role_id}/permissions

Response:

{
  "role_id": 1,
  "permissions": [
    { "id": 1, "name": "user:create" },
    { "id": 2, "name": "user:delete" }
  ]
}

POST /users/{user_id}/roles

Request:

{
  "role_ids": [1, 2]
}

Response:

{
  "user_id": 10,
  "assigned_roles": [1, 2]
}

GET /users/{user_id}/roles

Response:

{
  "user_id": 10,
  "roles": [
    { "id": 1, "name": "admin" },
    { "id": 2, "name": "editor" }
  ]
}

GET /users/{user_id}/permissions

Response:

{
  "user_id": 10,
  "permissions": [
    "user:create",
    "user:delete",
    "article:publish"
  ]
}

POST /access/check

Request:

{
  "user_id": 10,
  "permission": "article:publish"
}

Response:

{ "allowed": true }