TUTORIAL 04 · INTERMEDIATE

RBAC and Record Ownership

Protect ServiceDesk operations with ADMIN, AGENT and USER roles plus record-level ownership semantics.

RAIQL 1.025 minProject: ServiceDesk
By the end of this tutorial
  • Declare roles and default role
  • Understand ANY versus OWN permissions
  • Generate owner-aware reads and mutations
  • Test 401/403/ownership behavior

Add the ServiceDesk roles

ADMIN can manage every Ticket. AGENT can read and update Tickets. USER can create, read and update only records owned by that user.

app.raiql
CREATE APPLICATION "RAIQL ServiceDesk";
TYPE WEB;

USE STACK
  FRONTEND NEXTJS,
  BACKEND NEXTJS,
  DATABASE POSTGRESQL;

CREATE USER ENTITY User;

CREATE ENTITY Ticket (
  id UUID PRIMARY,
  title STRING REQUIRED,
  description STRING,
  status STRING REQUIRED,
  priority STRING REQUIRED,
  ownerId UUID REQUIRED
);

CREATE CRUD Ticket;
CREATE API Ticket;

ADD AUTHENTICATION EMAIL_PASSWORD, JWT;
ADD ROLE ADMIN, AGENT, USER;
DEFAULT ROLE USER;

RELATE Ticket.ownerId TO User.id;
OWN Ticket BY ownerId;

ALLOW ADMIN CREATE Ticket, READ Ticket, UPDATE Ticket, DELETE Ticket;
ALLOW AGENT READ Ticket, UPDATE Ticket;
ALLOW USER CREATE OWN Ticket, READ OWN Ticket, UPDATE OWN Ticket;

ENVIRONMENT development, staging, production;
SECRET DATABASE_URL;
SECRET RAIQL_JWT_SECRET;

BUILD;
DEPLOY DOCKER;

Understand the policy

  • ALLOW ADMIN READ Ticket means unrestricted role-level access to Ticket
  • ALLOW USER READ OWN Ticket limits access to the authenticated subject's records
  • CREATE OWN ignores a client-supplied ownerId and uses the JWT subject
  • UPDATE OWN first verifies record ownership

Generate and inspect the policy

terminal
raiql generate
cat generated/src/raiql/access-policy.json

Run authorization tests

RAIQL-generated security tests exercise declared access policy. Add GENERATE TESTS when you want executable regression tests for the application contract.

terminal
# add GENERATE TESTS; to app.raiql
raiql test --env development

Design rule

RAIQL ruleUse role permissions for broad application responsibilities and OWN permissions when access must follow the authenticated user at record level.
Previous← Authentication with Email, Password and JWT