Roles & Permissions (RBAC)

// app/api/invoices/route.ts
import { requirePermission } from '@auris/nextjs/server'
 
const config = {
  domain: process.env.NEXT_PUBLIC_AURIS_DOMAIN!,
  clientId: process.env.NEXT_PUBLIC_AURIS_CLIENT_ID!,
}
 
export const GET = requirePermission('view:invoices', config, async (req, { session }) => {
  // Only reached if the user has view:invoices permission
  const invoices = await getInvoices(session.user.id)
  return Response.json(invoices)
})
 
export const POST = requirePermission('create:invoices', config, async (req, { session }) => {
  const body = await req.json()
  const invoice = await createInvoice(body, session.user.id)
  return Response.json(invoice, { status: 201 })
})

// Check a permission in a Server Component
import { checkPermission } from '@auris/nextjs/server'
 
export default async function AdminSection() {
  const canManageUsers = await checkPermission('manage:users')
 
  if (!canManageUsers) {
    return <p>You do not have permission to manage users.</p>
  }
 
  return <UserManagementPanel />
}

import { useCheckPermission, usePermissions } from '@auris/react'
 
// Check a single permission
function InvoiceActions() {
  const { allowed: canCreate, isLoading } = useCheckPermission('create:invoices')
  const { allowed: canDelete } = useCheckPermission('delete:invoices')
 
  if (isLoading) return null
 
  return (
    <div>
      {canCreate && <button>New Invoice</button>}
      {canDelete && <button>Delete Selected</button>}
    </div>
  )
}
 
// Check multiple permissions at once
function DashboardNav() {
  const { has, hasAll, hasAny } = usePermissions([
    'view:invoices',
    'view:quotes',
    'manage:users',
    'view:billing',
  ])
 
  return (
    <nav>
      {has('view:invoices') && <a href="/invoices">Invoices</a>}
      {has('view:quotes') && <a href="/quotes">Quotes</a>}
      {has('manage:users') && <a href="/users">Users</a>}
      {has('view:billing') && <a href="/billing">Billing</a>}
      {hasAll(['view:invoices', 'view:quotes']) && <a href="/documents">All Documents</a>}
      {hasAny(['manage:users', 'manage:roles']) && <a href="/admin">Admin</a>}
    </nav>
  )
}

import { PermissionGate } from '@auris/react'
 
// Conditionally render UI based on permission
function InvoicePage() {
  return (
    <div>
      <h1>Invoices</h1>
 
      {/* Only renders if user has create:invoices */}
      <PermissionGate permission="create:invoices">
        <button>New Invoice</button>
      </PermissionGate>
 
      {/* Render a fallback for unauthorized users */}
      <PermissionGate
        permission="delete:invoices"
        fallback={<span>Read-only access</span>}
      >
        <button>Delete Selected</button>
      </PermissionGate>
    </div>
  )
}

import { AurisClient } from '@auris/js'
 
const auris = new AurisClient({ domain: 'auth.yourdomain.com', clientId: 'your-client-id' })
 
// Check a single permission
const result = await auris.permissions.checkOne('manage:users')
console.log(result.allowed) // boolean
 
// Check multiple permissions at once
const results = await auris.permissions.check([
  'view:invoices',
  'create:invoices',
  'delete:invoices',
])
 
results.forEach((result) => {
  console.log(`${result.permission}: ${result.allowed}`)
})
 
// Get all permissions the current user has
const allPermissions = await auris.permissions.listUserPermissions()
console.log(allPermissions) // string[] — e.g., ['view:invoices', 'create:quotes', ...]