implement basic role-based access control with auth0

Author: byron-okta

README.md

@@ -1,10 +1,10 @@
-# Standard Library/Golang: API Basic Access Control Code Sample
+# Standard Library/Golang: API Basic Role-Based Access Control (RBAC) Code Sample
 
-This Golang code sample demonstrates **how to implement authorization** in Standard Library API servers using Auth0.
+This Golang code sample demonstrates **how to implement Role-Based Access Control (RBAC)** in Standard Library API servers using Auth0.
 
 This code sample is part of the ["Auth0 Developer Resources"](https://developer.auth0.com/resources), a place where you can explore the authentication and authorization features of the Auth0 Identity Platform.
 
-Visit the ["Standard Library/Golang Code Sample: Authorization For Basic APIs"](https://developer.auth0.com/resources/code-samples/api/standard-library/basic-authorization) page for instructions on how to configure and run this code sample and how to integrate it with a Single-Page Application (SPA) of your choice.
+Visit the ["Standard Library/Golang Code Sample: Role-Based Access Control For Basic APIs"](https://developer.auth0.com/resources/code-samples/api/standard-library/basic-role-based-access-control) page for instructions on how to configure and run this code sample and how to integrate it with a Single-Page Application (SPA) of your choice.
 
 ## Why Use Auth0?
 

pkg/helpers/helpers.go

@@ -7,6 +7,15 @@ import (
 	"os"
 )
 
+func Contains(s []string, e string) bool {
+	for _, a := range s {
+		if a == e {
+			return true
+		}
+	}
+	return false
+}
+
 func SafeGetEnv(key string) string {
 	if os.Getenv(key) == "" {
 		log.Fatalf("The environment variable '%s' doesn't exist or is not set", key)

pkg/middleware/auth.go

@@ -1,6 +1,7 @@
 package middleware
 
 import (
+	"context"
 	"log"
 	"net/http"
 	"net/url"
@@ -16,10 +17,46 @@ import (
 )
 
 const (
-	missingJWTErrorMessage = "Requires authentication"
-	invalidJWTErrorMessage = "Bad credentials"
+	missingJWTErrorMessage       = "Requires authentication"
+	invalidJWTErrorMessage       = "Bad credentials"
+	permissionDeniedErrorMessage = "Permission denied"
 )
 
+type CustomClaims struct {
+	Permissions []string `json:"permissions"`
+}
+
+func (c CustomClaims) Validate(ctx context.Context) error {
+	return nil
+}
+
+func (c CustomClaims) HasPermissions(expectedClaims []string) bool {
+	if len(expectedClaims) == 0 {
+		return false
+	}
+	for _, scope := range expectedClaims {
+		if !helpers.Contains(c.Permissions, scope) {
+			return false
+		}
+	}
+	return true
+}
+
+func ValidatePermissions(expectedClaims []string, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		token := r.Context().Value(jwtmiddleware.ContextKey{}).(*validator.ValidatedClaims)
+		claims := token.CustomClaims.(*CustomClaims)
+		if !claims.HasPermissions(expectedClaims) {
+			errorMessage := ErrorMessage{Message: permissionDeniedErrorMessage}
+			if err := helpers.WriteJSON(w, http.StatusForbidden, errorMessage); err != nil {
+				log.Printf("Failed to write error message: %v", err)
+			}
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
 func ValidateJWT(audience, domain string, next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		issuerURL, err := url.Parse("https://" + domain + "/")
@@ -34,6 +71,9 @@ func ValidateJWT(audience, domain string, next http.Handler) http.Handler {
 			validator.RS256,
 			issuerURL.String(),
 			[]string{audience},
+			validator.WithCustomClaims(func() validator.CustomClaims {
+				return new(CustomClaims)
+			}),
 		)
 		if err != nil {
 			log.Fatalf("Failed to set up the jwt validator")

pkg/router/router.go

@@ -13,7 +13,10 @@ func Router(audience, domain string) http.Handler {
 	router.HandleFunc("/", middleware.NotFoundHandler)
 	router.HandleFunc("/api/messages/public", middleware.PublicApiHandler)
 	router.Handle("/api/messages/protected", middleware.ValidateJWT(audience, domain, http.HandlerFunc(middleware.ProtectedApiHandler)))
-	router.Handle("/api/messages/admin", middleware.ValidateJWT(audience, domain, http.HandlerFunc(middleware.AdminApiHandler)))
+	router.Handle("/api/messages/admin",
+		middleware.ValidateJWT(audience, domain,
+			middleware.ValidatePermissions([]string{"read:admin-messages"},
+				http.HandlerFunc(middleware.AdminApiHandler))))
 
 	return middleware.HandleCacheControl(router)
 }