Setting up Authorization (and improving docs?)

[Jacobjepsen27]

Hey there,

Is it possible to update the documentation to include a section about Authorization and how to get started?

I looked into the source code and noticed that Authorization.ts takes an Authenticator.ts instance. So, my initial thought is that I should use an authenticator instance when I don't care about permissions/roles, and the authorization instance when I do.

I would really appreciate it if someone could take a look at the example below and nudge me in the right direction.
My setup would be something along the lines of:

// Setup
export let authenticator = new Authenticator(sessionStorage);
export let authorizer = new Authorizer(authenticator, defaultRules);


// In loader without authorization
export let loader = (params: LoaderFunctionArgs) => {
  return authenticator.isAuthenticated(params.request, {
    failureRedirect: "/",
  });
};


// In loader with authorization
const ruleFunction: RuleFunction<any, any> = async (context) => {
// validate permissions/roles etc
 return true or false
};

export let loader = (params: LoaderFunctionArgs) => {
    return authorizer.authorize(params, { rules: [ruleFunction] });
};

[sergiodxa]

The Authorizer class is not documented on purpose, it’s not stable, I never really ended up using it so I’m not convinced it’s the best API for that use case which is why I don’t consider it stable and recommend it.

[Jacobjepsen27]

Alright, thank you for taking the time to answer.

[osseonews]

This is a good discussion topic. Actually, I had a similar question: Are there any examples that fully implement Remix Auth that should be referenced when building an app with Remix Auth? It's difficult to know exactly how all the files should be set up, at least in a way that will work long-term. So would be great to provide some example repos that show how to set this up correctly. Thanks.

[sergiodxa]

You can see how I use it on my own website https://github.com/sergiodxa/sergiodxa.com/blob/main/app/modules/auth.server.ts, but there's nothing special to do aside of what's in the readme.

1. Create the Authenticator
2. Setup the strategies
3. Call authenticate or isAuthenticated

Kent's EpicStack also use Remix Auth here https://github.com/epicweb-dev/epic-stack/blob/main/app/utils/auth.server.ts.