RBAC and ReBAC authorization demo using Oso Cloud
This repository demonstrates the evolution of authorization systems from basic RBAC to advanced ReBAC using Oso Cloud. Each branch represents a different implementation approach:
| Branch | Implementation | Description |
|---|---|---|
main ⭐ |
Oso RBAC + ReBAC | Latest implementation with relationship-based access control for expense sharing |
v2-oso-rbac |
Oso Cloud RBAC | Role-based access control using Oso Cloud with trip-level permissions |
v1-basic-rbac |
Basic RBAC | Simple role-based access control without external authorization service |
- Compare v1 → v2: See how Oso Cloud RBAC was implemented
- Compare v2 → v3: See how ReBAC was added for expense sharing
- Compare v1 → v3: See the full transformation
v1 (Basic RBAC)
- Simple role-based permissions
- Database-stored roles
- Basic middleware authentication
v2 (Oso RBAC)
- Centralized authorization with Oso Cloud
- Declarative policy definitions
- Enhanced security and auditability
v3 (Oso RBAC + ReBAC) ⭐
- Relationship-based access control
- Fine-grained expense sharing permissions
- Advanced authorization patterns
Follow these steps to set up the project:
-
Clone the repository:
git clone https://github.com/aydrian/shared-travel-app.git cd shared-travel-app -
Install dependencies:
bun install
-
Set up environment variables:
cp .dev.vars.example .dev.vars
Edit the
.dev.varsfile and fill in the required values:BETTER_AUTH_SECRET: A secret key for Better AuthBETTER_AUTH_URL: The URL for Better Auth (default is http://localhost:3000)
-
Set up the database schema:
bun run db:push
-
Seed the database:
bun run db:seed
-
Start the development server:
bun run dev
TThis project uses Cloudflare D1 as the database, which is a serverless SQL database. We use Drizzle ORM for database operations and schema management. Here are some useful commands for managing your database:
-
Generate migration files:
bun run db:generate
-
Apply migrations:
bun run db:migrate
-
Open Drizzle Studio for visual database management:
bun run db:studio
Drizzle ORM provides type-safe database queries and schema definitions. For more information on how to use Drizzle ORM in your project, refer to the Drizzle ORM documentation.
For more information about Cloudflare D1, refer to the Cloudflare D1 documentation.
This application uses Better Auth for authentication. It is configured to use email and password authentication.
| Route | Method | Description |
|---|---|---|
/api/auth/signup |
POST | Create a new user account |
/api/auth/signin |
POST | Sign in with email and password |
/api/auth/signout |
POST | Sign out and end the current session |
/api/auth/session |
GET | Get information about the current session |
/api/auth/reset-password |
POST | Request a password reset |
/api/auth/reset-password/:token |
POST | Reset password using a token |
For more details on using Better Auth, refer to the Better Auth documentation.
| Route | Method | Description | Required Permissions |
|---|---|---|---|
/api/trips |
GET | List all trips for the user | Authenticated |
/api/trips |
POST | Create a new trip | Authenticated |
/api/trips/:tripId |
PATCH | Update a trip | Trip Organizer |
/api/trips/:tripId |
DELETE | Delete a trip | Trip Organizer |
/api/trips/:tripId |
GET | Get trip details | Trip Organizer, Participant, Viewer |
/api/trips/:tripId/participants |
POST | Add or update a participant | Trip Organizer |
/api/trips/:tripId/participants |
GET | List all participants | Trip Organizer, Participant, Viewer |
/api/trips/:tripId/participants/:userId |
PATCH | Update a participant's role | Trip Organizer |
/api/trips/:tripId/participants/:userId |
DELETE | Remove a participant | Trip Organizer |
/api/trips/:tripId/expenses |
GET | List all expenses for a trip | Trip Organizer, Participant, Viewer |
/api/trips/:tripId/expenses |
POST | Add a new expense | Trip Organizer, Participant |
/api/trips/:tripId/expenses/:expenseId |
GET | View a specific expense | Expense Owner, Shared-with User, Trip Organizer |
/api/trips/:tripId/expenses/:expenseId |
PATCH | Update an expense | Expense Owner, Trip Organizer |
/api/trips/:tripId/expenses/:expenseId |
DELETE | Delete an expense | Expense Owner, Trip Organizer |
/api/trips/:tripId/expenses/:expenseId/share |
POST | Share expense with user | Expense Owner, Trip Organizer |
/api/trips/:tripId/expenses/:expenseId/share |
DELETE | Unshare expense from user | Expense Owner, Trip Organizer |
/api/trips/:tripId/expenses/:expenseId/shares |
GET | Get expense sharing details | Expense Owner, Shared-with User, Trip Organizer |
This project uses Vitest as the testing framework to ensure the reliability and correctness of our code, particularly for verifying our Role-Based Access Control (RBAC) authentication.
To run the test suite, use the following command:
bun run testOur tests are located in the tests directory and are organized to mirror the structure of our src directory. Key test files include:
tests/routes/trips.test.ts: Tests for trip-related routes and permissionstests/routes/participants.test.ts: Tests for participant-related routes and permissionstests/routes/expenses.test.ts: Tests for expense-related routes and permissions
We have comprehensive tests to verify our RBAC authentication system. These tests ensure that:
- Users can only access routes they have permission for
- Different roles (Organizer, Participant, Viewer) have the correct access levels
- Unauthorized access attempts are properly rejected
For example, in our trip routes tests, we verify that:
- Only authenticated users can list and create trips
- Only organizers can update or delete trips
- Organizers, participants, and viewers can view trip details
This project is licensed under the MIT License - see the LICENSE file for details.
This app was created using the Better Hono template.