Introduction to Authorization & Role-Based Access Control (RBAC)

🌍 Introduction

In the previous lessons, we implemented authentication, which verifies who a user is.
Now, we need authorization, which controls what a user can do.

In this lesson, you'll learn: ✅ What authorization is and why it’s important.
✅ The difference between authentication and authorization.
✅ How Role-Based Access Control (RBAC) works.
✅ Different authorization strategies for APIs.

---

📌 1. What is Authorization?

Authorization determines what actions a user is allowed to perform after being authenticated.

🔹 Example:

• A regular user can only access their own todos.
• An admin can manage all users' todos.

Without proper authorization, a user could delete another user's data, leading to security issues.

---

📌 2. Authentication vs. Authorization

🔹 Authentication → Verifies who you are (Login)
🔹 Authorization → Verifies what you can do (Permissions)

Feature	Authentication	Authorization
Purpose	Identifies a user	Controls user actions
Happens When?	Before authorization	After authentication
Example	Logging in with a password	Checking if a user can access an admin page
Technologies	Passwords, JWT, OAuth	RBAC, permissions

---

📌 3. Authorization Strategies in APIs

There are different ways to control user access:

✅ 1️⃣ Role-Based Access Control (RBAC)

🔹 Users have predefined roles (e.g., admin, user).
🔹 Permissions are assigned based on roles.

Example:

Role	Actions Allowed
Admin	Manage all users & todos
User	Manage only their own todos

---

✅ 2️⃣ Attribute-Based Access Control (ABAC)

🔹 Access is granted based on attributes (e.g., department, location).
🔹 More flexible than RBAC.

Example:

• A user from HR can access employee records.
• A manager can approve requests in their department.

---

✅ 3️⃣ Permission-Based Authorization

🔹 Instead of assigning roles, users get specific permissions.
🔹 More fine-grained control than RBAC.

Example:

User	Permissions
Alice	can_create_todos, can_edit_own_todos
Bob (Admin)	can_create_todos, can_edit_all_todos, can_delete_users

---

📌 4. Role-Based Access Control (RBAC) in a TodoList API

We'll assign roles and protect routes in the next lesson.

🔹 Users Table (MongoDB)

{
  "_id": "656a7f3bc4d91b0012a8d849",
  "name": "Alice",
  "email": "alice@example.com",
  "password": "hashedpassword",
  "role": "user"
}

🔹 Admins will have access to more routes:

Endpoint	User	Admin
GET /todos (own todos)	✅ Allowed	✅ Allowed
DELETE /users/:id	❌ Denied	✅ Allowed

---

🎯 Summary

✅ Authorization controls what users can do in an API.
✅ RBAC assigns permissions based on roles (Admin/User).
✅ Fine-grained control is possible using ABAC or permission-based access.

---

✅ Next Lesson: Implementing Role-Based Authorization in APIs

In the next lesson, we’ll implement role-based authorization in our TodoList API! 🚀