Access Control

Zen provides two access control strategies - roles and granular permissions - both checked via middleware after authentication.

Strategies

Strategy	Scope	Check
RBAC	Broad roles ("admin", "editor")	RequireRole("admin")
PBAC	Granular permissions ("read:users")	RequirePermission("read:users"), RequireAnyPermission(...), RequireAllPermissions(...)
Claims	Specific claim values	RequireClaim("tenant", "acme")

See the dedicated RBAC and PBAC pages for usage details.

Setting Roles and Permissions

Roles and permissions are represented as authorities on the User struct returned by your authenticator:

func MyAuthenticator(r *http.Request) (*auth.User, error) {
    return &auth.User{
        ID:       "123",
        Username: "john",
        Authorities: auth.Authorities(
            "role:admin",
            "role:editor",
            "read:users",
            "write:reports",
        ),
    }, nil
}

Claim-Based Enforcement

Use RequireClaim when access should depend on a specific claim value:

r.Use(auth.RequireAuth(jwtAuth))
r.Use(auth.RequireClaim("tenant", "acme"))

Enforcement Order

Apply RequireAuth first, then the access control middleware:

r.Use(auth.RequireAuth(jwtAuth))
r.Use(auth.RequireRole("admin"))
r.Use(auth.RequirePermission("read:users"))
r.Use(auth.RequireClaim("tenant", "acme"))