454: Workshop design with Aji Slater

Hello, and welcome to another episode of the Bike Shed, a weekly podcast from your friends at Thoughtbot about developing great software. I'm Joel Kenville. And today, I'm joined by fellow Thoughtbotter, Adi Slater. Howdy. And together, we're here to share a little bit of what we've learned along the way. So, Aji, what's new in your world? In my world, I've been getting to play with a concept that was new to me upon joining the client project that I'm with right now. That's one of the things that I really love about consulting is that not only do you get introduced to different businesses and different teams, but you might also get assigned to a project with a new kind of, like, tech or concept that you haven't been introduced to. And this one in particular is to revamp our clients' access control system. They've gotten a little bit bigger. They've gotten more sophisticated in their needs. Their hand rolled system that they started out with is not working out for them anymore. And so they're moving on to a relational based access control system. And that's actually something that I had, not really encountered. I've set up role based access control plenty of times, but the relationship idea was new to me. You familiar with that? No. Explain to me what, relational access control is and how that differs from more conventional role based access. Yeah. So the relational access control, the underlying data structure is a directed graph. So you'll have different entities, resources, and subjects in this particular case that have a relationship to one another. So the entities are the nodes in the graph and the relationship being the edge. This way, you can connect between two points in that graph. Say it's a user and, like, a post or something that a user might own. If there is any kind of connection along that graph between those two points, then that is a allowed permission. And so it's kind of an easy way to conceptualize what can get pretty complicated if you're going to have different access control needs on particular individual items in a system. So in this case, basically, my user record just gets a connection to every entity in the system that I have access to. Yeah. There's a couple of different ways to handle it. Because it's a directed graph, you can have a relationship to something like a group or an organization or even a role. You can build role based access control on top of these systems so that if you have a connection to a role or an organization and then from the other direction, entities have a connection to that organization saying anyone that is related to you can also edit or whatever with me, then you have both fine grain control of the user directly connected to a particular instance, or you can have that kind of group control of, a more broad allowances. …