diff --git a/README.md b/README.md index 195ca02..1753519 100644 --- a/README.md +++ b/README.md @@ -3,12 +3,20 @@ This repository explores how to build a access control system on top of SurrealDB using TypeScript. We will build a nodejs backend command line application that uses the SurrealDB Javascript/Typescript SDK to connect to a local SurrealDB instance. We will authenticate with various users and display a list of 'product' entries from a test database. +The built-in access control system in SurrealDB has "access granularity levels" for ```Root```, ```Namespace```, ```Database``` and ```Scope``` with the roles ```Owner```, ```Editor``` and ```Viewer```. ```DEFINE SCOPE``` is deprecated in favor of ```DEFINE ACCESS``` though. -We will use ```DEFINE ACCESS``` statements to define roles based authentication. One of our test users should be able to fully access (create, read, update, delete) -the 'product' entries the other one should not have access to the table and thus should not be able to retrieve a list of products. +We will use ```DEFINE ACCESS``` statements to define a log in method that makes use of user entries in +a table aka ```record users``` which allows us to come up with a more fine grained access control system than the built-in one. We will have two test users one of which should be able to select from a *product* table and display a list of products. The other test user should not have access to this table. -First we add the SDK to our project ```npm install --save surrealdb```. -Then we need to initialize our database. ```ts-node backend/src/init_db.ts``` +First we add the SDK to our project. +```bash +npm install --save surrealdb +``` + +Then we need to initialize our database. +```bash +ts-node backend/src/init_db.ts +``` ## The setup We have the three essential tables *user*, *role* and *product*. The table *product* could be replaced by @@ -29,7 +37,7 @@ We create two example users *appuser1* and *appuser2* and the role *product_manager*. Also we need a product so we create *testproduct* in the *product* table. -Users having the role *product_manager* should be able to select from the *product* table the others should not. [*Record users*](https://surrealdb.com/docs/surrealdb/security/authentication#record-users) have +Users having the role *product_manager* should be able to select from the *product* table the others should not. [```Record users```](https://surrealdb.com/docs/surrealdb/security/authentication#record-users) have no rights initially by definition and thus must be granted permissions first. So we create links from *user:appuser1* to *role:product_manager* in the *has_role* table and a link