Can I use LogTo RBAC to implement resource-scoped permissions?

[andy250]

Building a small SaaS with LogTo + Blazor Server (.net8). The basic setup worked for me. I will have multiple Organizations, each with multiple users and multiple projects (dynamically created over time). I need to set permissions per project level. So user A requires Read on project X and Read+Write on project Y. Is this doable in LogTo? Can I simply add permissions that include the project ID as part of the permission name? E.g. permission:read:project:x, permission:read:project:y? Is there a limit on number of permission in LogTo? (the number of projects will grow over time).

[simeng-li]

Hey Adny, nice to meet U. As you mentioned currently all the RBAC permissions are defined at the resource level in Logto. So what exactly do you mean by "projects" in your system? Are these individual applications, distinct services, or some other resource entities?

[andy250]

Hey @simeng-li. In my system projects are resource entities. If my product was github, then a single project would equal to github's single repository (which belongs to a user, has read/write permissions specified per user etc).

[simeng-li]

I see. Sounds totally doable to me.

Feel free to set as many permissions as needed – there are no restrictions on the number. You can certainly use permission:read:project:x format to define those permissions.

Explore either the resource-based RBAC or leverage organization permissions based on your preferences. The key distinction lies in whether you seek permission during an API request for resource access or when attempting to access the resources of an organization. It really depends on your use case, whichever fits your resource structure.

P.S. probably you would like to check our organization template feature which allows you to define roles template across multiple organizations. e.g. define roles based on different projects you have. So you may easity assign them cross orgs.