Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
What specific authorization question does RBAC answer, and what related question does it NOT answer on its own?
💻 Code Challenge | +75 XP
Implement a hierarchical RBAC system with viewer/editor/admin roles (editor inherits viewer, admin inherits editor), a requirePermission middleware, and demonstrate it combined with a separate per-resource ownership check on a DELETE /orders/:id route.
A security audit found a user with an "editor" role could delete any order in the system, not just their own, because the DELETE route only checked the RBAC permission and nothing else. Reorder the steps to add the missing layer.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Assuming an RBAC permission check alone is sufficient authorization for a resource-specific operation
// Insufficient alone: any editor can delete ANY order
app.delete("/orders/:id", requirePermission("orders:delete"), deleteOrder);
// Correct: RBAC AND per-resource ownership, both required
app.delete("/orders/:id", requirePermission("orders:delete"), checkOrderOwnership, deleteOrder);The Solution //
RBAC determines whether a role is permitted to perform a kind of action in general (can editors delete orders at all?), but it has no inherent concept of resource ownership — a separate, explicit check verifying the specific requester has rights to the specific resource in question is still required, exactly the gap covered in Broken Access Control.
The Error //
Duplicating a full permission list at every role level instead of using role hierarchy/inheritance
// Duplicated, error-prone to maintain
viewer: ["orders:read"]
editor: ["orders:read", "orders:write"] // duplicated "orders:read"
admin: ["orders:read", "orders:write", "users:write"] // duplicated again
// Correct: hierarchical inheritance, defined once
const hierarchy = { viewer: [], editor: ["viewer"], admin: ["editor"] };The Solution //
Without inheritance, a shared permission (like being able to view orders, which every role should have) must be manually duplicated into every single role's definition — updating that shared permission later requires remembering to update it in every role that includes it, rather than in one place.