Node.js Backend Development Bootcamp · Lección

Control de acceso basado en roles (RBAC)

Implemente una autorización basada en roles para restringir el acceso a determinados endpoints según los roles y permisos de los usuarios.

Control de acceso basado en roles (RBAC) es una lección gratuita de Node.js Backend Development Bootcamp en CoddyKit. Esta es la lección 6 de 6. Puedes leer la lección completa abajo gratuitamente — luego la practicas en el navegador con un editor de código integrado y un tutor de IA 24/7. Forma parte de la ruta de aprendizaje de Node.js Backend Development Bootcamp, y tu progreso se sincroniza en la web y la app de CoddyKit. El curso de Node.js Backend Development Bootcamp incluye 6 lecciones en total.

Partes de esta lección aún no han sido traducidas y se muestran en inglés.

What is RBAC?

Role-Based Access Control (RBAC) is a method of restricting access to resources based on the roles individual users have within an organization.

Instead of assigning permissions directly to users, permissions are assigned to roles.
Users are then assigned to roles, inheriting those permissions.
This simplifies security management, especially in larger applications.

Defining User Roles

First, we need to define the roles our application will use. These are typically broad categories like 'admin', 'editor', or 'basic_user'.

Using a Python Enum is a clean way to manage these roles:

from enum import Enum

class UserRole(str, Enum):
    ADMIN = "admin"
    EDITOR = "editor"
    BASIC_USER = "basic_user"

# Example usage:
# role = UserRole.ADMIN

User Role Assignment

Every user in your system will have one or more roles associated with them. In a real FastAPI application, this information usually comes from the user's authenticated token (e.g., a JWT payload).

For this lesson, we'll use a simple User model and a mock function to represent the currently authenticated user with their assigned roles.

from typing import List
from pydantic import BaseModel
from enum import Enum

class UserRole(str, Enum):
    ADMIN = "admin"
    EDITOR = "editor"
    BASIC_USER = "basic_user"

class User(BaseModel):
    username: str
    roles: List[UserRole]

# Mock function to get current user (normally from JWT)
async def get_current_user() -> User:
    # In a real app, this would decode a JWT
    # For demonstration, let's return a mock admin user
    return User(username="admin_user", roles=[UserRole.ADMIN])

Custom Role Dependency

FastAPI's dependency injection system is perfect for implementing RBAC. We can create a custom dependency that checks if the authenticated user has the necessary role(s) to access an endpoint.

This dependency will be reusable across many endpoints.
If the user doesn't have the required role, it raises an HTTPException.

Building the Role Checker

Our role_required dependency will take a list of roles. It will then fetch the current user and verify if any of their assigned roles match the required roles.

from fastapi import Depends, HTTPException, status
from typing import List
from pydantic import BaseModel
from enum import Enum

class UserRole(str, Enum):
    ADMIN = "admin"
    EDITOR = "editor"
    BASIC_USER = "basic_user"

class User(BaseModel):
    username: str
    roles: List[UserRole]

# Mock function to get current user
async def get_current_user() -> User:
    return User(username="test_user", roles=[UserRole.BASIC_USER])

def role_required(required_roles: List[UserRole]):
    async def role_checker(current_user: User = Depends(get_current_user)):
        if not any(role in current_user.roles for role in required_roles):
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail="Not enough permissions"
            )
        return current_user
    return role_checker

Code: Admin-Only Endpoint

Here's a full FastAPI application demonstrating how to protect an endpoint so only users with the 'admin' role can access it. Run this code and try accessing /admin and /public.

from fastapi import FastAPI, Depends, HTTPException, status
from typing import List
from pydantic import BaseModel
from enum import Enum
import uvicorn

app = FastAPI()

class UserRole(str, Enum):
    ADMIN = "admin"
    EDITOR = "editor"
    BASIC_USER = "basic_user"

class User(BaseModel):
    username: str
    roles: List[UserRole]

# Mock function to get current user
# Change roles here to test different access levels
async def get_current_user() -> User:
    # Try changing to [UserRole.BASIC_USER] or [UserRole.ADMIN]
    return User(username="admin_user", roles=[UserRole.ADMIN])

def role_required(required_roles: List[UserRole]):
    async def role_checker(current_user: User = Depends(get_current_user)):
        if not any(role in current_user.roles for role in required_roles):
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail="Not enough permissions"
            )
        return current_user
    return role_checker

@app.get("/public")
async def read_public_data():
    return {"message": "This is public data!"}

@app.get("/admin")
async def read_admin_data(current_user: User = Depends(role_required([UserRole.ADMIN]))):
    return {"message": f"Welcome, {current_user.username}! This is admin data."}

if __name__ == "__main__":
    uvicorn.run(app, host="0.0.0.0", port=8000)

Testing the Role Check

When you run the previous code:

Access http://127.0.0.1:8000/public: This should always work.
Access http://127.0.0.1:8000/admin: This will work if get_current_user returns a user with UserRole.ADMIN.

Try changing the mock user's roles in get_current_user to [UserRole.BASIC_USER] and rerun the app. You'll see a 403 Forbidden error when trying to access /admin.

Allowing Multiple Roles

Sometimes, an endpoint should be accessible by more than one role. For example, both 'admin' and 'editor' users might be allowed to update an article.

Our role_required dependency is already designed for this! It accepts a List[UserRole], and the any() check means access is granted if the user has any one of the specified roles.

Code: Multiple Role Access

This example shows an endpoint accessible by either an 'admin' or an 'editor'. Try changing the mock user's roles to [UserRole.EDITOR] and [UserRole.BASIC_USER] to observe the access control.

from fastapi import FastAPI, Depends, HTTPException, status
from typing import List
from pydantic import BaseModel
from enum import Enum
import uvicorn

app = FastAPI()

class UserRole(str, Enum):
    ADMIN = "admin"
    EDITOR = "editor"
    BASIC_USER = "basic_user"

class User(BaseModel):
    username: str
    roles: List[UserRole]

# Mock function to get current user
# Change roles here to test different access levels
async def get_current_user() -> User:
    # Try [UserRole.ADMIN], [UserRole.EDITOR], or [UserRole.BASIC_USER]
    return User(username="editor_user", roles=[UserRole.EDITOR])

def role_required(required_roles: List[UserRole]):
    async def role_checker(current_user: User = Depends(get_current_user)):
        if not any(role in current_user.roles for role in required_roles):
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail="Not enough permissions"
            )
        return current_user
    return role_checker

@app.get("/edit_content")
async def edit_content(current_user: User = Depends(role_required([UserRole.ADMIN, UserRole.EDITOR]))):
    return {"message": f"Hello {current_user.username}! You can edit content."}

@app.get("/view_only")
async def view_only_content(current_user: User = Depends(role_required([UserRole.BASIC_USER]))):
    return {"message": f"Hello {current_user.username}! You can view content."}

if __name__ == "__main__":
    uvicorn.run(app, host="0.0.0.0", port=8000)

RBAC Implementation Check

You need to create an endpoint /dashboard that should only be accessible by users with the ADMIN role. Which of the following is the correct way to apply the role_required dependency?

RBAC Recap

You've learned how to implement Role-Based Access Control in your FastAPI applications:

Defined roles using Python Enum for clarity.
Understood how user roles are typically associated (e.g., via JWTs).
Created a reusable custom dependency (role_required) to check user roles.
Applied this dependency to endpoints to restrict access based on single or multiple roles.

RBAC is a powerful way to manage permissions, making your API more secure and maintainable!

Preguntas frecuentes

¿La lección «Control de acceso basado en roles (RBAC)» es gratis?

Sí — el texto completo de «Control de acceso basado en roles (RBAC)» es gratis para leer aquí en la web. Para practicarla de forma interactiva (editor de código integrado y tutor de IA 24/7) y desbloquear el resto del curso de Node.js Backend Development Bootcamp, actualiza a CoddyKit PRO. El curso de Node.js Backend Development Bootcamp incluye 6 lecciones en total.

¿Qué aprenderé en «Control de acceso basado en roles (RBAC)»?

Implemente una autorización basada en roles para restringir el acceso a determinados endpoints según los roles y permisos de los usuarios. Practicas Node.js Backend Development Bootcamp con código real que ejecutas directamente en el navegador, y un tutor de IA 24/7 responde tus preguntas mientras trabajas en la lección.

¿Necesito experiencia previa para empezar Node.js Backend Development Bootcamp?

No se requiere experiencia previa. Node.js Backend Development Bootcamp en CoddyKit está estructurado para principiantes hasta estudiantes avanzados, así que puedes empezar aquí o desde el inicio y avanzar a tu ritmo. Esta es la lección 6 de 6.

¿Cuánto tiempo toma la lección «Control de acceso basado en roles (RBAC)»?

La mayoría de las lecciones de CoddyKit toman alrededor de 5–10 minutos. Cada una es compacta e interactiva, así que avanzas constantemente y retomas exactamente por donde dejaste en la web y la app.

¿Puedo escribir y ejecutar código en esta lección de Node.js Backend Development Bootcamp?

Sí. Cada lección de Node.js Backend Development Bootcamp incluye un editor de código integrado, así que escribes y ejecutas código real directamente en tu navegador y obtienes retroalimentación instantánea de IA — sin configuración local necesaria.

Todas las lecciones de este curso

Registro e inicio de sesión de usuarios
Generación y validación de tokens JWT
JWT para autenticación sin estado
Integración del flujo de contraseña de OAuth2
Control de acceso basado en roles
Control de acceso basado en roles (RBAC)

← Volver a Node.js Backend Development Bootcamp