Role-Based Access Control

RBAC lets you restrict access based on roles assigned to a user.

Role checks are performed against the user's Authorities list using the standard role:NAME format.

RequireRole

// Requires "admin" role, sends 403 on failure
r.Use(auth.RequireRole("admin"))

// Custom error handler
r.Use(auth.RequireRole("admin", func(c *zen.Ctx) {
    c.Error(403, "admins only")
}))

Must be used after RequireAuth since it reads the user from the context.

Programmatic Checks

user := auth.GetUser(c)
if user.RequireRole("editor") {
    // user has the editor role
}

You can populate roles in the same Authorities list:

return &auth.User{
    ID:       "123",
    Username: "john",
    Authorities: auth.Authorities("role:admin", "role:editor"),
}, nil