Flexible Authorization:Storing and Managing Rules in DB
summary
Claims that authorization rules live in the database so end users can edit them, implemented with policy gems (Pundit or CanCan) while storing JSONB actions and conditions and roles/activities rows. Builds a query DSL generator with live preview plus a parser that emits selects/joins/filters for scoping, and uses the parsed condition tree to evaluate and call authorize for permit/403 outcomes. Prototype works for per-request allow/deny and scoping but notes unresolved performance and conflict resolution issues.
AI-written summary · about
chapters (5)
related talks
41mAccess Denied: the missing guide to authorization in Rails
26mAuthorization in a Service-Oriented Environment
27mAuthorization in the GraphQL era
45mNext Generation Authorisation using Cedar
25mModernizing Authorization: From Basic Roles to Decoupled ABAC
45mThe Future of Authorization in Applications
32mImplementing Authorization
06mThe Root of Auth Things