---
# System prepended metadata

title: Untitled

---

Some intial thoughts around RBAC/ABAC for Degreed

TODO: Need to think about API scopes.

```typescript=

export interface User {
  id: string;
}

export interface RoleGroup {
  id: string;
  userId: string;
  roleId: string;
  effectiveDate: Date;
}

interface AccessControl {
  id: string;
  name: string;    
}

export interface Role extends AccessControl {
  applicationId: string;
}

export interface Permission extends AccessControl {
  tags: string[];
  operationIds: string[];
}

export interface Policy extends AccessControl {
  tags: string[];
  permissions: Partial<Permission>[];
}



```
## RoleGroup
Assign users to one or more roles with an date that the role would be effective from.

| id       | userId   | roleId   | effectiveDate |
| -------- | -------- | -------- | ------------- |
| rg1      | u1       | r1       | 2022-01-01    |



## Role
A role is used by various applications.

| id       | name     | applicationId | policyIds |
| -------- | -------- | ------------- | --------- |
| r1       | Member   | Web           | p1, p2    |


## Policy
Not sure about the name here but essentially used to group various permissions together in a human readable form so they can be assigned to a role.

| id       | name         | tags     | permissions                 |
| -------- | ------------ | -------- | --------------------------- |
| p1       | Skill Review | Text     | skills:read, skills:view    |
| p2       | Text         | Text     |                             |


## Permission
These are the actual permssions that are used in the backend api to define an API can be invoked or the front end button to be visible/disabled.

| id              | name         | tags     | 
| --------------- | ------------ | -------- |
| skills:read     | Read Skills  | api      |
| skills:view     | View Skills  | ui       |

Eg:

```C#
// PermissionKey.GetSkills = "skills:read"

public class SkillsController : ApiControllerBase
{
  [HttpGet]
  [Authorize(PermissionKey.GetSkills)]
  public async Task<IActionResult> GetSkills()
  {
    var result = await Mediator.Send(new GetSkillsQuery());
    return result.MatchResponse();
  }
}
```

The Permission can be bound to various FE buttons, menu options etc to control visibility. I personally prefer an option not being visible rather than showing an option is disable to due lack of permissions.