Role-Based Access Control

The Role-Based Access Control (RBAC) subsystem in APIJSON restricts client requests based on the caller's authenticated identity, requested table/model, and HTTP method. Authorization rules are enforced centrally by AbstractVerifier using metadata definitions, role hierarchies, and mapping tables APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java55-61

1. Core Roles and ROLE_MAP

APIJSON defines six standard roles representing varying levels of privilege within the system. These roles are declared as constants in AbstractVerifier:

• UNKNOWN: Unauthenticated or anonymous visitors APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java74-76
• LOGIN: Authenticated users with a valid user identifier (userId > 0) APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java78-80
• CONTACT: Contacts of the resource owner, requiring login APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java82-84
• CIRCLE: Circle members (CONTACT + OWNER), requiring login APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java86-88
• OWNER: The designated owner of the target record (userId == userId) APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java90-92
• ADMIN: Administrative users with elevated permissions APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java94-96

These roles are mapped internally within AbstractVerifier.ROLE_MAP, which associates each role string with evaluation criteria or query constraint templates APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java104-137

Title: "Mapping Roles to Verification Entries in AbstractVerifier"

Sources: APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java74-137

2. Access Metadata and @MethodAccess

Access permissions for models and tables are declared using the @MethodAccess annotation or stored in database configuration tables like Access APIJSONORM/src/main/java/apijson/orm/model/Access.java16-18 and Request APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java120

• @MethodAccess: Specifies which roles are permitted to execute each RequestMethod (GET, HEAD, GETS, HEADS, POST, PUT, DELETE) on a given model/table APIJSONORM/src/main/java/apijson/MethodAccess.java29-65
• Access Model: Represents table-level access policies stored in persistent storage APIJSONORM/src/main/java/apijson/orm/model/Access.java13-18
• SYSTEM_ACCESS_MAP & ACCESS_MAP: Internal static caches within AbstractVerifier that store parsed role-permission matrices for system and user models APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java110-161

Title: "Bridging MethodAccess Metadata to AbstractVerifier Maps"

Sources: APIJSONORM/src/main/java/apijson/MethodAccess.java29-65 APIJSONORM/src/main/java/apijson/orm/model/Access.java13-18 APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java110-161

3. The Visitor Interface

The Visitor<T> interface provides contextual identity information regarding the client executing the request APIJSONORM/src/main/java/apijson/orm/Visitor.java13-19 It supplies:

• getId(): Returns the unique identifier of the current visitor APIJSONORM/src/main/java/apijson/orm/Visitor.java15
• getContactIdList(): Returns a list of contact identifiers associated with the visitor, used for verifying CONTACT and CIRCLE roles APIJSONORM/src/main/java/apijson/orm/Visitor.java17

Sources: APIJSONORM/src/main/java/apijson/orm/Visitor.java13-19

4. Verification Flow

When a request arrives, AbstractVerifier validates both the requested method against the allowed roles in ACCESS_MAP / SYSTEM_ACCESS_MAP and evaluates the content rules APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java69-113 If ENABLE_VERIFY_ROLE is active, any role mismatch throws an authorization exception APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java69

Sources: APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java69-113