module-user

Flow

Authentication

User can have many identities. For each type of identity, there will be an authentication way to create a session for the user (for example, if identity is email, the user can authenticate via firebase, identity is password, then authenticate via password and username,...)

When the session is created, the server returns the token to the client. The client will save this token in localStorage, and send it in the API header for authentication each time it calls the API

Authorization

The system includes many roles (can be created by the system at first, or created by the user). Each role will include many permissions. The user is assigned a role with a specified scope. Each API may require certain permissions for scopes. When the user has permission with the corresponding scope, he will be able to access the API.

For example, API GET /groups/123 requests ReadGroup permission with scope module and scope group 123. Users assigned to the role with ReadGroup permission with scope module or scope group with scopeId of 123 will be able to access the API. If the user is assigned ReadGroup permission with scope group and scopeId 124, he will not be able to access this API.