Golang Microservices Full Course #20 - Role Based Access Control (RBAC)

Summary

The tutorial implements role-based access control (RBAC) in a Go wallet application. It distinguishes authentication—verifying a user with a JWT—from authorization—checking whether that user’s role permits an action.

Roles and access

• User: Can view their own wallet and balance, and make transfers.
• Admin: Can access broader user and wallet information. Possible administrative actions, such as freezing accounts, are discussed as future uses.

Implementation

1. Database and model: Add a role column to the users table through an up/down migration, then add the role to the user model.
2. JWT claims: Include the user’s role in JWT claims and pass it through token-generation and login/register code.
3. Authorization middleware: Read the role from the request context and check it against the role required by a protected route.
4. Protected routes: Separate regular protected routes from admin-only routes, and add a sample admin endpoint, such as GET /admin/users.
5. Testing and debugging: Set a test user’s role to admin in the database, log in to obtain a token with the updated role, and test access to the admin endpoint.

Debugging notes

The presenter found that user lookup queries did not retrieve and scan the role field. After updating the queries, the role became available to the middleware. The presenter then logged in again to get a fresh token and confirmed access to the simulated admin control panel.

Main speaker/source: A single presenter/instructor from the Ikhda Muhammad Wildani channel.