Advanced Authorization Queries
A single permit.check() answers one question about one user, action, and resource. Advanced queries answer broader ones:
which resources a user can access, which users can act on a resource, and what a user can do across tenants.
Every query below uses the same example.
Alice and Bob are users in a blogging application. Here's how they interact with the blog posts:
| User | Blog Post(s) | Permissions |
|---|---|---|
| Alice | Blog Post 1, Blog Post 2 | Edit, Read (Full permissions for her posts) |
| Bob | Blog Post 3 | Edit, Read (Full permissions for his post) |
| Alice | Blog Post 3 | Read (View only) |
| Bob | Blog Post 1, Blog Post 2 | Read (View only) |
Alice and Bob need to query the system to:
- Determine what permissions they have for specific blog posts.
- Retrieve blog posts they are allowed to view or edit.
- List the users who can perform actions on a given blog post.
Bulk Check
The permit.bulkCheck function checks multiple permissions in a single call. Use it when Alice or
Bob needs permissions for several blog posts at once.
Example: Alice Checks Read Permissions
Alice wants to know which blog posts she can read.
Alice can read Blog Post 1, Blog Post 2, and Blog Post 3. One call returns all three decisions, instead of one round trip per post.
You can read more about the bulk check here.
FilterObjects
Use the permit.filterObjects function to perform PDP-level filtering.
You fetch the data from your database, then pass it to filterObjects, which returns the subset of objects
the policy allows.
For example, fetch all posts from the database and use permit.filterObjects to display only the ones Alice or Bob is authorized to see.
Example: Alice Filters Blog Posts
Alice wants to retrieve the blog posts she can edit.
The function returns Blog Post 1 and Blog Post 2, as Alice has edit permissions for these posts.
Get Authorized Users
Use the permit.authorized_users function to retrieve a list of users authorized to perform a specific action on a resource.
This function takes an action and resource as inputs and returns the authorized users along with their role assignments that
granted access.
Example: Retrieve Authorized Users
Bob wants to know who can read Blog Post 3.
The system responds with:
- Alice (has read permissions).
- Bob (has edit and read permissions).
You can read more about getting resource authorized users here.
Get User Permissions
Use the permit.GetUserPermissions function to retrieve all user permissions across all registered resources and tenants.
Pass a user, optionally filter by a list of tenants, and get back an object with the permissions
and attributes for each tenant the user is assigned to.
Example: Bob's Permissions
The system returns a list of Bob's permissions:
- Blog Post 1: Read
- Blog Post 2: Read
- Blog Post 3: Read, Edit
You can read more about getting user permissions here.
What did you learn?
What's next? 🎉
- Implement bulk permission checks to optimize authorization workflows
- Use policy-based filtering to retrieve only relevant data
- Query and manage user permissions dynamically
No Authorization Query stands a chance now!