AI Powered SaaS: Stripe + Auth + Billing + Deploy · レッスン

ロールベースアクセス制御（RBAC）

ユーザー権限とアクセスレベルを管理する、堅牢なロールベースアクセス制御（RBAC）システムを設計・実装します。

レッスン 3/410 ステップ

「ロールベースアクセス制御（RBAC）」はCoddyKit上の無料AI Powered SaaS: Stripe + Auth + Billing + Deployレッスンです。これはレッスン3/4です。下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。これはAI Powered SaaS: Stripe + Auth + Billing + Deploy学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 AI Powered SaaS: Stripe + Auth + Billing + Deployコースには全4レッスンが含まれています。

このレッスンの一部はまだ翻訳されておらず、英語で表示されています。

Intro to RBAC

Welcome to Role-Based Access Control (RBAC)! In any SaaS application, not all users should have the same access or abilities.

RBAC is a powerful method to manage user permissions based on their assigned roles. Instead of managing permissions for each individual user, you group permissions into roles and then assign roles to users.

This approach simplifies administration, improves security, and makes your application more scalable.

Roles & Permissions Defined

Let's clarify two core concepts:

Role: A collection of permissions. Think of roles as job functions within your application, like 'Admin', 'Editor', 'Viewer', or 'Account Manager'. A user can have one or many roles.
Permission: A specific action that can be performed, such as create_post, edit_user_profile, delete_invoice, or view_dashboard. Permissions are the granular actions.

Users inherit all permissions granted to their assigned roles.

RBAC Data Model

To implement RBAC, you need a way to store users, roles, and permissions, along with how they relate. This typically involves several database tables:

Users: Stores user information (e.g., ID, name, email).
Roles: Stores role names (e.g., ID, 'Admin', 'Editor').
Permissions: Stores specific permission names (e.g., ID, 'create_post').

The key is linking these entities together.

Building the RBAC Schema

Relationships are crucial for RBAC. We use 'many-to-many' relationships, which require join tables:

users (id, name, email)
roles (id, name)
permissions (id, name)

And then the join tables:

user_roles (user_id, role_id): Links users to roles.
role_permissions (role_id, permission_id): Links roles to permissions.

This structure allows a user to have multiple roles and a role to have multiple permissions.

User Role Assignment

Once your data model is set up, you can assign roles to users. A user can have one role (e.g., 'Admin') or multiple roles (e.g., 'Editor' and 'Viewer').

For example, in a database:

User Alice (user_id: 1) is assigned the Admin role (role_id: 101).
User Bob (user_id: 2) is assigned the Editor role (role_id: 102).
User Charlie (user_id: 3) is assigned both Editor (role_id: 102) and Viewer (role_id: 103) roles.

Charlie would inherit all permissions from both 'Editor' and 'Viewer' roles.

Checking User Permissions

Now, let's see how you'd check if a user has a specific permission in your code. The logic involves iterating through a user's roles and then checking those roles' permissions.

Try running this example:

import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.util.HashMap;
import java.util.Arrays;

public class RBAC {
    private static final Map<String, List<String>> ROLE_PERMS = new HashMap<>();
    static {
        ROLE_PERMS.put("Admin", Arrays.asList(
            "create_user", "edit_user", "delete_user",
            "view_dashboard"));
        ROLE_PERMS.put("Editor", Arrays.asList(
            "create_post", "edit_post", "view_dashboard"));
        ROLE_PERMS.put("Viewer", Arrays.asList("view_dashboard"));
    }

    static class User {
        List<String> roles;
        public User(List<String> roles) {
            this.roles = roles;
        }
        public List<String> getRoles() {
            return roles;
        }
    }

    public static boolean hasPermission(User user, String requiredPerm) {
        if (user == null || user.getRoles() == null) {
            return false;
        }
        for (String roleName : user.getRoles()) {
            List<String> perms = ROLE_PERMS.get(roleName);
            if (perms != null && perms.contains(requiredPerm)) {
                return true;
            }
        }
        return false;
    }

    public static void main(String[] args) {
        User admin = new User(Arrays.asList("Admin"));
        User editor = new User(Arrays.asList("Editor"));
        User viewer = new User(Arrays.asList("Viewer"));
        User guest = new User(new ArrayList<>());

        System.out.println("Admin has 'create_user': " +
            hasPermission(admin, "create_user"));
        System.out.println("Editor has 'delete_user': " +
            hasPermission(editor, "delete_user"));
        System.out.println("Viewer has 'view_dashboard': " +
            hasPermission(viewer, "view_dashboard"));
        System.out.println("Admin has 'create_post': " +
            hasPermission(admin, "create_post"));
        System.out.println("Guest has 'view_dashboard': " +
            hasPermission(guest, "view_dashboard"));
    }
}

Implementing with Middleware

In a web application, RBAC checks are often implemented using middleware or filters.

This code runs before your main endpoint logic, checking if the authenticated user has the necessary permissions for the requested action.

If not, access is denied (e.g., a 403 Forbidden error is returned) without executing the endpoint's logic.

Centralized Checks: Avoids repeating permission logic in every endpoint.
Clean Endpoints: Keeps your main business logic focused.
Scalability: Easier to add new roles or permissions.

RBAC Best Practices

To make your RBAC system effective and secure, consider these best practices:

Principle of Least Privilege: Grant users only the minimum permissions necessary to perform their tasks. Avoid giving too much access.
Clear Role Naming: Use descriptive names for roles (e.g., 'ProductManager', 'SupportAgent') and permissions (e.g., 'read_product_feedback').
Audit Trails: Log all changes to roles, permissions, and user assignments to maintain accountability.
Regular Review: Periodically review your roles, their assigned permissions, and user assignments to ensure they remain appropriate.

Test Your Knowledge

A user named Sophia has been assigned the Analyst role. The Analyst role has the permissions view_reports and export_data.

The Admin role, which Sophia does NOT have, includes permissions like view_reports, manage_users, and delete_data.

If Sophia attempts to perform an action that requires the manage_users permission, what will be the outcome?

対話的なレッスンで答える

Recap: RBAC Essentials

Well done! You've learned the fundamentals of Role-Based Access Control.

RBAC uses roles (collections of permissions) to manage user access efficiently.
Key components include Users, Roles, and Permissions, linked by join tables.
You implement RBAC by checking if a user's roles grant a specific permission.
Middleware is often used to centralize permission checks in web applications.
Following best practices like the Principle of Least Privilege ensures a secure and maintainable system.

RBAC is a cornerstone for building secure and scalable SaaS applications.

無料で開始

AI チューターと学ぶ AI Powered SaaS: Stripe + Auth + Billing + Deploy — 無料

ブラウザでリアルコードを書いて実行し、24/7 の AI チューターから瞬時にサポートを受け、ウェブまたはアプリで続きから学習できます。

コース: 12
レッスン: 48

無料で学習を始めるコース全体を表示

よくある質問

「ロールベースアクセス制御（RBAC）」レッスンは無料ですか？

はい。「ロールベースアクセス制御（RBAC）」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、AI Powered SaaS: Stripe + Auth + Billing + Deployコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 AI Powered SaaS: Stripe + Auth + Billing + Deployコースには全4レッスンが含まれています。

「ロールベースアクセス制御（RBAC）」で何を学びますか？

ユーザー権限とアクセスレベルを管理する、堅牢なロールベースアクセス制御（RBAC）システムを設計・実装します。ブラウザで直接実行するハンズオンコードでAI Powered SaaS: Stripe + Auth + Billing + Deployを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。

AI Powered SaaS: Stripe + Auth + Billing + Deployを始めるのに経験は必要ですか？

事前経験は必要ありません。CoddyKitのAI Powered SaaS: Stripe + Auth + Billing + Deployは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。これはレッスン3/4です。

「ロールベースアクセス制御（RBAC）」レッスンにはどのくらい時間がかかりますか？

ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。

このAI Powered SaaS: Stripe + Auth + Billing + Deployレッスンでコードを書いて実行できますか？

はい。すべてのAI Powered SaaS: Stripe + Auth + Billing + Deployレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。

このコースのすべてのレッスン

← AI Powered SaaS: Stripe + Auth + Billing + Deployに戻る