Roles and Permissions are now customizable in the PropelAuth backend, and this new change handles that. A user still has a single role, but now we give a list of all roles that role "inherits" from, plus a list of permissions associated with that role. These are populated in OrgMemberInfo.
There are three basic attributes to handle these changes, alongside some associated functions:
- use_role is now **user_assigned_role**. It's now a straight string instead of an enum. Check for this exact role with **user_is_role**() method.
- **user_inherited_roles_plus_current_role** is a list of all roles that this user "inherits". Instead of checking roles with < and >, you should check for the existence of the role in this list using the new **user_is_at_least_role**() method.
- **user_permissions** is a list of all permissions this user has. These are the four propelauth-specific permissions (e.g. enabling SAML, deleting users, etc) plus any custom permissions you've added to the assigned role. Check for these permissions with the **user_has_permission**() and **user_has_all_permissions**() methods.
Also included with these changes are four new validation functions to that will throw appropriate errors, plus four wrappers to work with access tokens.
Other changes in relation to customizable RBAC roles:
- Removed UserRole enum, the concept of minimum required roles, and the associated UnexpectedException.
- New exception: ForbiddenException.user_doesnt_have_required_permission
The basic function **validate_access_token_and_get_user_with_org** has been changed to **validate_access_token_and_get_user_with_org_by_minimum_role**. If you do nothing else with your code, update this.