Permit.io를 사용하여 Couchbase 데이터에 외부 RBAC 적용하기

As web applications grow in complexity, ensuring that only the right users have access to your Couchbase data is essential.

Without a well-defined access control system, unauthorized users may access sensitive information or perform harmful actions.

Integrating Permit with Couchbase provides a robust solution for managing access control in applications leveraging Couchbase as the database. Permit is designed to streamline the authorization process, enabling developers to implement fine-grained access control while leveraging the advanced data management capabilities of Couchbase.

In this guide, we walk through building a simple request system where we pass a Couchbase query and check whether the relevant user has access to run that query based on rule-based format checks. If the user lacks permission, they’ll be denied from running the query, if they have permission, they can proceed.

카우치베이스(Couchbase)는 무엇인가요?

Couchbase is a robust NoSQL database, optimized for storing and managing JSON documents. Its ability to handle JSON objects is what sets it apart from traditional key value stores. This flexibility allows developers to be able to store, retrieve, and manage unstructured or semi-structured data easily, making it extremely useful for applications with evolving data models.

One of the key strengths of Couchbase is its SQL++ querying capability which provides a familiar SQL-like syntax for JSON documents (formerly known as N1QL). This enables developers to perform powerful queries on their JSON data such as being able to add common table expressions, joins, and much more. This Couchbase query layer allows data to be stored in JSON format while also supporting sophisticated queries.

What is RBAC?

Role-Based Access Control (RBAC) is a model that helps simplify permission management inside of applications by organizing the system permissions around roles rather than specific individuals. It provides an approach to manage and restrict access to specific resources within a particular application or organization.

To implement external Role-Based Access Control with Couchbase, we will leverage Permit.io, an end-to-end solution for managing user permissions and roles with a simple UI. We will create a React application with the Express packet where the user passes the SQL++ query with the help of Couchbase. Then, we will see whether the user has the relevant permission. If they don’t, we’ll send out a message. If they do, we can modify the request.

Set up a Couchbase Cluster

The first step is to create a free Capella account. To do this, navigate to cloud.couchbase.com and choose Create Account, use an email and password combination. You can also sign up with your GitHub or Google account.

Once you have created your account on Capella, you can proceed with creating your database cluster. You can choose the Free tier option for the cluster.

From the home page of your account, after logging in, click the + Create Database button in the top right corner and fill in the required details, including the name you chose for the database.

When you are ready, go ahead and click on the final Create Database button.

You have now created a cluster. The next step is to add a bucket to hold your data. A bucket is similar to a database table, but with significant differences. Since you are working with unstructured and semi-structured JSON data, a single bucket can hold diverse types of data.

Head over to the Data Tools section, where you will find a pre-imported dataset known as the 여행 샘플 dataset.

You can insert more documents or create completely new buckets if needed. But for this demo we will use the 여행 샘플 dataset.

The following figure illustrates the relationship between the different kinds of documents in the travel-sample dataset. It shows the primary key, ID, and type fields that each document has, along with some other representative fields in each type of document.

We will use this dataset for our demo. In order to interact with your data on Capella from your application, you need to know the connection string and create access credentials.

You can find the connection string by clicking the Connect button in the top navigation bar of the dashboard.

To add access credentials, navigate to this page in your Capella settings, as shown below, and click the + Create Database Access button. Provide a name and password, then click Save. Make sure to immediately add the credentials to an .env file, as you won’t be able to retrieve the password again after this.

After creating your credentials, your Capella setup is complete. Let’s move to the RBAC part!

Set up RBAC Permissions in Permit.io

Ensure you have set up your account on Permit.io and created a project. In this demo, we will use the default project that was created.

Head over to the Policy Editor section, and within the Resources section, add the relevant resources corresponding to the 여행 샘플 dataset.

In this case, we will add the resources as Route, Airport, Hotel, 그리고 Airline.

Ensure that you have added the relevant actions.

Next, head over to the Roles section to add the specific user roles associated with the travel sample dataset.

For the dataset we’re using, you will need to add the following roles: Traveler, Travel Agent, Airline Staff 그리고 Hotel Staff.

Now, head over to the Policy Editor section and define the relevant role-based access control definitions for each specific role corresponding to the resources defined. You can refer to the image below for the specific attributes to help create the policies. Then, go to the Policy Editor, check all the checkboxes as shown below, and save your changes.

Next, head to the directory section to create a new tenant. Once you have created the tenant, add users based on their roles.

We will create new users for hotel staff, travel agents, and travelers.

For each user, add their email, first name, last name, and specific role in the top-level access section.

That’s all it took to create a Role-Based Access Control (RBAC) model for the travel sample dataset using Permit UI.

Implementing Fine-Grained RBAC for Couchbase with Permit.io

Now let’s implement our Couchbase SQL++ query parser with Permit.

First, we’ll set up a Node.js project with Express for our backend server. We’ll use the Couchbase SDK for Node.js and the Permit.io SDK.

Here’s our package.json file with the necessary dependencies:

Implementing the Server

Let’s break it down into key components:

Initialization

We start by setting up our Express server and initializing the Permit.io client:

Parsing SQL++ Queries

To work with the incoming Couchbase queries, we need to parse them. We’ve implemented a simple parser that extracts the SELECT, FROM, and WHERE clauses from the input query.

Let’s look at the core components of our parser:

Query Parser

The QueryParser class is the foundation of our security implementation. It handles two critical tasks:

1. Query Analysis: Parses SQL++ queries to determine:

• Operation type SELECT, UPDATE, DELETE, INSERT
• Resource being accessed
• Query structure validation

 

2. Security Validation: Implements security checks to prevent SQL injection and other attacks:

Permission Management

그 TravelQueryChecker class handles the core permission logic:

1. Initialization: Sets up connections to both Permit.io and Couchbase:

 

1. Permission Checking: Verifies user permissions through Permit.io:

This function uses the Permit.io SDK to check if a user has permission to perform a specific action on a resource.

3. 쿼리 실행: Handles the complete flow from permission check to query execution:

API Endpoint

Finally, we expose an API endpoint to handle incoming queries:

 

Couchbase Connection

We will now define the Couchbase connection code in our backend Express server, which helps us to connect to the Couchbase Cluster:

Frontend Code

To demonstrate the functionality for the integration, we’ve created a simple React frontend that allows users to input queries and see the results.

For setup, you can check this code for the existing UI components:

This given React component allows users to enter a query and their user identifier, then displays the results or any permission-related errors.

For the complete code, check out the Permit-Demo GitHub repository.

Demo

With everything in place, you can run the backend Express server and the React application separately. Once both are running, you will see a UI like the one below. Add the query and the corresponding user, then click the Check Permissions button.

In the example above, you can see the user who has permission and the user who does not have permission to access the resource.

결론

In this tutorial, we explored how to set up and configure Permit to add RBAC settings for the Couchbase travel-sample dataset and how to check for permissions for a given SQL++ query.

What if you want a more granular level of control than user roles, focusing on user-specific identities? For that and more, we recommend continuing to explore our learning materials, such as the difference between RBAC and ABAC 그리고 adding ABAC to your application with Permit.

Want to learn more about implementing authorization? Got questions? Reach out to us in our Slack community.