A minimalistic role-based ACL implementation for Teapot Smalltalk HTTP microframework.
acl := TeaACL new
addRole: #admin;
addRole: #superadmin;
addResource: '/documents';
"it supports good ol' Teapot route globs"
addResource: '/documents/<id>';
"privileges could pretty much be anything suiting your needs - it's definitely not limited to HTTP verbs"
allowRole: #admin toAccess: '/documents' withPrivileges: #(POST GET);
allowRole: #admin toAccess: '/documents/<id>' withPrivileges: #(GET PUT DELETE);
"it supports a shortcut to allow everything for a given role"
allowRole: #superadmin toAccess: '*' withPrivileges: #(GET).
...
"returns true"
acl checkRole: #admin toAccess: '/documents?foo=bar&bar=baz' withPrivilege: #GET.
"superadmin is the god here. returns true"
acl checkRole: #superadmin toAccess: '/foo/bar' withPrivilege: #GET.
"nobody is allowed to access a route not matching to any glob. returns false"
acl checkRole: #admin toAccess: '/xxx' withPrivilege: #GET.
"a user with undeclared role is not allowed to access this. returns false"
acl checkRole: #outsider toAccess: '/documents' withPrivilege: #GET.
Metacello new
baseline: 'TeapotACL';
repository: 'github:https://radekbusa/Teapot-ACL';
load.
- Add this to application bootstrap by leveraging Teapot filters:
teapot before: '*' -> [ :req | middleware checkAuthorization: req ];
- Middleware>>checkAuthorization: aRequest
| token userRole requestUri |
token := self getToken: aRequest.
userRole := token payload at: #role. "To be modified. User role is stored in a JSON Web Token in this scenario."
requestUri := aRequest uri asString.
"Config>>ACL contains a preconfigured TeaACL instance."
(config ACL checkRole: userRole toAccess: requestUri withPrivilege: aRequest method) ifFalse: [
aRequest abort: (TeaResponse code: 403).
].
Tested in Pharo 7, 8 and 9.
Radek Busa is the author and maintainer of this project.
- Tech blog: www.medium.com/@radekbusa
- Hire me for your next Smalltalk project: www.radekbusa.eu
"I love building enterprise-grade software products in no time and Pharo greatly contributes to that with its amazing debugger, test-driven environment and other great stuff, such as refactoring tools. My vision is to build libraries for ultra-productive enterprise microservice development with minimalistic and easy-to-grasp APIs for Smalltalk in 2020s."
If you endorse my vision and/or this project helped you, please don't hesitate to donate. Your donations will be welcome!