Ask IH: Best way to implement user permissions/roles.

Django comes with permissions. Nominal use is 1. Create group, 2. Assign permissions to groups, 3. Add users to groups. Whether you use it or not the docs can give you one view.

You may find some solutions out there, and most of the are likely undeveloped or don't really sufficiently support in-depth use cases. For instance you can go with Django, but you'll find in a few weeks/months that it doesn't grant you what you really need.

You might also find that some authN providers give you claims. That also isn't going to get you what you need and is also a terrible user experience.

The reason I say is my experience in the development of permissions models. We specifically went out and tried to find good solutions to problems like this, but ended up needing to build our own. We tried open source versions and still got us no where. As a result we've opened up our implementation as something that others can utilize which comes with all the features and flavors of user permissions you could ever need.

Even using something built into your framework, you'll likely end up on this unfortunate path

Roles/permissions can definitely be large task, especially if they weren't considered from the get go. I would definitely see if there are any libraries in your chosen programming language and/or framework that you can leverage to start you off. For example, I'm currently using Rails and have used Pundit (https://github.com/varvet/pundit) with much success.

That being said, Pundit in particular doesn't make any assumptions about how a user's roles/permissions are stored, but you may be able to find one that does. This StackOverflow answer with an SQL schema for storing RBAC data also seems to be a good starting point: https://stackoverflow.com/q/190257/583478

With anything authentication/authorization based, I generally find Auth0 to be
a good resource. Even if you don't end up using their service they typically have informative articles, and, at the very least, you could consider modeling your own system like theirs: https://auth0.com/docs/users/assign-permissions-to-users

Authentication at the server (JWTs) and authorization at the database (row level security).

I've read that you're using Node.js and I'm assumung you're using dome kind of library/framework that supports middleware.

I'd write a custom middleware that accepts or rejects a request based on what group does user authenticated user belongs to.

Both what @rab and @cbaclig are good answers.

A couple questions:

1. how much control do you want?
2. what's your tech stack?

Both matter for whether you outsource or build.