Throughauth, authorization defined in the UI

Overview

Pick the parts of the UI a role may see, and derive the API rules from that.

Throughauth is a work-in-progress library built on the idea of creating authorization based on what parts of the UI have been assigned to a role. From the UI selection, a process called tracing determines which network calls and which fields in the network responses are used by that part of the UI, along with which actions can be called from it.

Since pages are dynamic in most cases, there can be more than one selection per page, and each one can have a condition that determines which selection is active for the current state of the page. Conditions are parts of the page as well.

Tracing

Tracing watches the DOM to learn which response fields actually matter.

Tracing is a process that, based on all possible values of fields in the response of a network call, determines which fields affect that part of the UI, i.e. the DOM. If a change in a value causes a change in the DOM, that field is allowed to be accessed by the role.

After a change in the API, tracing can be restarted so the authorization rules stay up to date. After a change in the UI, tracing can be used to find the parts of the UI that should be visible in the new UI. All authorization is enforced at the API level as well.

Stack