How To Handle Permissions Like A Senior Dev

Permission systems are in every single app, but most developers don’t spend any time planning out their system which results in buggy, hard to maintain code. In this video I will cover how to create multiple levels of permission systems from very basic all the way up to advanced systems that many companies charge thousands of dollars for.

📚 Materials/References:

🌎 Find Me Here:

⏱️ Timestamps:

00:00 - Introduction
01:17 - Problems With Roles
03:00 - RBAC (Role Based Access Control)
06:20 - RBAC Limitations
08:48 - Clerk Implementation
14:40 - Database Diagrams
19:23 - ABAC (Attribute Based Access Control) Explained
21:08 - Clerk Organization Implementation/Adding Multiple Roles
24:18 - ABAC Implementation
33:22 - Clerk ABAC Implementation

#Permissions #WDS #Authorization

[UCoviltwg]

I like how over time your channel covers more and more advanced topics. I feel like I've been growing in my career in a similar pace, so you always have me covered! Thank you

[man_of_men_]

This has really helped me at work! Thank you!

[WhispersatDusk-dyhy]

As someone who works on a permissions team, glad to see some coverage about it. Not talked about much but is crucial to get right. And try not to roll your own authorization unless your companies unique demands call for it.

[killerpixelk]

Great video!!! It's important to note that you have to handle permissions for both the client display AND the database action. For example, if you display the delete button for your own comments and clicking it results in `DELETE /api/comments/123` and someone can find the ID of another comment (maybe by looking at the XHR request for the listing page of comments) and issues their own DELETE fetch request to the other comment, your backend or DB has to also check permissions and not just delete the comment. Postgres can do row-based and column-based policies that makes that a lot easier to do that particular check on the backend.

[Gabifuertes]

15:42 This is what I've come up with on my own and have used for quite a bit. It's great to have someone show me the limitations and then how to overcome them. Thank you!

[FeelFreeToCode]

Fantastic video! The way you broke down handling permissions from a senior dev's perspective was so clear and practical. Definitely a must-watch for anyone serious about scaling their software development practices

[jareddiscipio]

Another great tutorial from one of the best content creators on YouTube!!! Keep it up man

[TheStallion]

more in this topic please, people usually skip this part and use ready solution, but building it up from scratch and understanding this topics is what differentiates a good dev from the others

[هواتف-مر]

This guy puts out quality educational content and for free !!!
Thanks man

[JohnGasper]

IAM professional here. Great job showing devs solid principals that can be applied to most projects, Clerk or not.

[elhaambasheerch]

26:00, "I am not really that great at typescript", says the guy who is my and many other self taught coders' favourite teacher.

Take a bow man.

[hernanbphb]

its been 4 min and I already feel the whole video will be worthwhile

[msahu]

Amazing 🤩 I have been searching for years for this video. But never find this kind of your where all kind of permission handling discussed in a single video with all advantages and disadvantages. Thankyou for this video 🥳

[Tszyu]

CASL is a great library with many integrations for handling complex decisioning like this

[someguyOW]

This is possibly one of the best resources hands down, on the topic.
You did a great job!

[juniordevlife]

Thanks! Great tip. I'm still working on a 20 year old application and rewrite it from scratch. I will use this advice. Top tip! Go forward with more of these practical topics.

[ziacodes]

Please do this more often, This is something I would learn everyday.

[karsh]

Lovely vid! First implementation is generally called CRUD, Create Read Update Delete. It's generally better to keep to the standard. The standar for all this called NIST INCITS 359-2012. My personal fav product for ABAC is called Axiomatics. Easy to work with both as dev and admin.

The whole point of ABAC from an enterprise view is to place the complexity where it belongs - at the business level. A chief enterprise architect may at any time be responsible for several dev projects. Dealing with different authorization models for every system becomes needlessly complex for every one. From this perspective, devs with ABAC skills become very valuable.

[opasanhandle]

This is an excellent topic for a video, even for experienced software engineers. The explanations are truly great. Well done!

[frikkie]

Using Bitmasking makes it even easier. That also solves the problem of permission inheritance from various roles - that way you only end up with one permission set per user, don't have to work with roles directly.