Sida Loo Ku Daro Xakamaynta Kartida Doorka (RBAC) App-ka

Si aad u ku darto xakamaynta kartida doorka, sii isticmaale kasta hal ama in ka badan oo door ah (tusaale admin, editor, viewer), qeex ficillada kasta door uu sameyn karo, oo hubi ogolaanshaha server-ka codsi kasta — ma aha oo keliya adigoo badhamada qarinaya. Sidoo kale hubi in diiwaanka la gelayo uu ku jiro akoonka ama kooxda isticmaalaha. Bilow doorar go'an oo fudud database-kaaga, kadibna tijaabi adigoo isku dayaya inaad gaarto xogta isticmaale kale si toos ah.

Authentication iyo authorisation

Laba eray oo badanaa is khaldaan:

• Authentication waa yaad tahay? — galitaanka. Eeg how to add login to your app.
• Authorisation waa waa maxay wixii laguu ogolyahay in aad samayso? — bogagga, diiwaanka iyo ficillada isticmaalaha galay ee gaari kara.

RBAC waa habka ugu caansan ee authorisation-ka. Waa muhiim: laga bilaabo Sebtember 2026, Broken Access Control waa #1 OWASP Top 10:2025, liiska caanka ah ee khataraha ugu waaweyn ee amniga websaydhka. Khaladaadka caadiga ah waa isticmaalayaasha oo akhrinaya diiwaanada isticmaalayaasha kale iyagoo beddelaya ID-ga URL-ka, ama isticmaalayaasha caadiga ah oo wicitaan u sameeya API-yada admin-ka oo keliya.

Dooro qaab

Dhaqanka, inta badan apps waxay isku daraan laba shay: doorarka waxa nooca ficillada qofku qaadi karo, iyo milkiilaha diiwaanka uu ku qaadi karo. "Tafatirayaashu way tafatiri karaan maqaalada" waa xeer door; "…maqaalada workspace-kooda" waa xeer milkiile. Labadaba waa in aad leedahay.

Bilow wax fudud intaad u malaynayso. Admin, member iyo viewer waxay daboolaan tiro ballaadhan oo app ah. Way fudud tahay in door la kala qaybiyo markii dambe intii aad ku xidhi lahayd toban door oo aan qofna sharxi karin.

Qeex doorarka ka hor intaadan code qorin

Marka hore qor miis ogolaansho oo luqadda caadiga ah ku qoran. Waxay u adeegtaa sidii spec-ka AI-ga iyo qorshaha tijaabintaada:

Go'aan kiisaska xadka ah sidoo kale: ma kaaga tegi karaa milkiilaha ugu dambeeya? Admin ma ka saari karaa milkiilaha? Maxay arkaan isticmaalaha la saaray?

Tallaabo tallaabo

1. Marka hore hel galitaan shaqeeya

RBAC wuxuu ku jiraa authentication-ka korkiisa. Server-ku waa inuu si isku halaysan u ogaado qofka codsi kasta sameynaya, session ama token la xaqiijiyay — marna ha ka helin user ID uu browser-ku ku daro jirka codsiga.

2. Kaydi doorarka database-ka

App hal kooxeed ah, tiir role oo ku jirta isticmaalayaasha waa wanaagsan tahay. Kooxaha, isticmaal miis xubinnimo:

create table memberships (
  user_id uuid references users(id),
  organization_id uuid references organizations(id),
  role text not null check (role in ('owner','admin','member','viewer')),
  primary key (user_id, organization_id)
);

Marna ha u ogolaan isticmaalayaasha inay doorkooda naftooda beddelaan update-ka profile-ka caadiga ah. Beddelidda doorka waa in ay mari endpoint gaar ah oo ogolaanshaha la hubiyay.

3. Hubi ogolaanshaha server-ka, hal meel

Qor hal helper — tusaale ahaan can(user, 'projects.delete', project) — oo wicitaan u samee API route kasta, server action kasta iyo background task kasta oo akhrinaya ama beddelaya xogta. Hal function oo dhexe ayaa way fudud tahay in la eego oo la tijaabiyo marka ka badan hubinta kala firdhsan koodka oo dhan. Caddaynta caadiga ah ee "ka diid": haddii ay ogolaansho aan xeer oggolaanin ficilka, la diidayaa.

4. Xaddid query kasta

Query kasta oo xogta kooxda ah waa inay ku jiraa kooxda: where organization_id = :currentOrg, ma aha oo keliya where id = :id. Tanina waxay joojinaysaa qof inuu /projects/123 u beddelo /projects/124 oo uu arko mashruuca shirkad kale. Ku soo celi "ma jiro" halkii "lama oggola" diiwaannada kooxaha kale, si aadan u muujin inay jiraan.

5. Ku dar ilaalinta heerka database-ka meelaha muhiimka ah

Postgres row-level security (RLS) wuxuu u ogolaanayaa database-ka inuu xukumo safafka uu isticmaale kasta arki karo. Waa muhiim haddii browser-ku si toos ah ula hadlo database-ka (sida qaar ka mid ah backend-yada martiqaadan), waana lakab dheeraad oo wanaagsan miisaska xasaasiga ah haddii kale.

6. Ka muuji doorarka interface-ka

Hadda qari ama curi wax isticmaaluhu aanu samayn karin, si app-ku u noqon aanu jahawareer ku ahayn. Tani waa mid kaliya loo isticmaalo u-habboonaanta; hubinta server-ka ayaa ilaalinaysa.

7. Diiwaan geli ficillada xasaasiga ah

Diiwaan geli yaa beddelay doorarka, tirtiray xogta ama soo dhoofiyay diiwaanada, iyo goorta. Diiwaanka dhegaysiga (audit log) wuxuu caawiyaa su'aalaha taageerada iyo dhacdooyinka.

8. Tijaabi sida weerare

U soo gal door kasta oo isticmaal ficil kasta oo ku jira miiska ogolaanshaha. Kadibna isku day waxyaabaha aan shaqayn waa inay: wici API route-yada admin-ka adigoo viewer ah, beddel ID-yada URL-ka iyo codsiyada, ka saar naftaada milkiilaha ugu dambeeya. Tijaabooyinka toosan ee miiska ogolaanshaha waa inaad qorto marka xeerarku xasilmaan.

Prompts-ka shaqeeya

Ku dar xakamaynta kartida doorka. Doorar kasta oo ku jira urur: owner, admin, member, viewer, oo lagu kaydiyo miis memberships ah. Ogolaanshaha waxaa ku jira miiskan: [ku dheji miiskaaga]. Samee hal helper server-side ah oo can(user, action, resource), ka diid wax kasta oo aan si cad loo ogolayn, oo isticmaal API route kasta. Xaddid query kasta organization_id. Ka qari ficillada isticmaaluhu sameyn karin UI-ga, laakiin ha ku tiirin ammaanta.

Dib u eeg API route kasta iyo server function kasta oo app-kan ku jira. Mid kasta sheeg xogta uu akhrinayo ama beddelayo, haddii uu hubiyo in isticmaaluhu galay, haddii uu hubiyo doorkiisa, iyo haddii uu xaddidayo query-ga kooxdiisa. Hagaaji kuwa hubinta maqan, oo i tus liiska.

Ku dar bog admin-ka kaliya oo milkiilaha uu ku beddeli karo doorarka xubnaha. Ka hortag in milkiilaha ugu dambeeya la saaro ama la hoos geeyo, diiwaan geli beddel kasta oo door ah oo leh cidda samaysay iyo waqtiga, oo hubi in endpoint-ka beddelka doorka uu diido qof kasta oo aan milkiile ahayn.

Khaladaadka caadiga ah

• Doorarka lagu hubiyo front end-ka oo keliya. API-ga qof kasta ayaa wici karaa.
• Aaminka ID-yada client-ka ka yimid — userId ama role jirka codsiga halkii session-ka.
• Query-yo aan xaddidnayn oo soo qaada diiwaanka ID-kiisa oo keliya.
• Doorarka lagu hubiyo bogagga laakiin aan API route-yada lagu hubin, soo dejinta, download-yada faylalka ama webhooks.
• Admin ku salaysan email cayiman oo lagu qoray koodka (if email === 'me@...'), taas oo fudud in la illoobo oo adag in la beddelo.
• Doorar badan oo hore, kuwaasoo qof aan sharxi karin lix bilood kadib.
• Session-yo hore u dhaqaaqay: isticmaale la hoos geeyay wuxuu haysanayaa xuquuqda admin ilaa uu ka baxo. Doorarka ka hubi database-ka, ama cusbooneysii, ficillada xasaasiga ah.

Liiska RBAC

• Miiska ogolaanshaha waxaa lagu qoray luqadda caadiga ah, go'aamada xadka ah waa la qaatay
• Server-ku wuxuu isticmaalaha ka ogyahay session-ka, marna ha ka ogaado xogta codsiga
• Doorarka waxaa lagu kaydiyaa database-ka; isticmaalayaashu ma beddeli karaan kuwa naftooda
• Hal hubin ogolaansho oo dhexe, ka diid wax kasta oo aan la ogolayn, oo route kasta isticmaala
• Query kasta waa in lagu xaddido ururka ama milkiilaha isticmaalaha
• Row-level security meelaha browser-ku database-ka ku gaari karo
• UI-ga ka qari wixii isticmaaluhu sameyn karin (u-habboonaanta keliya)
• Ficillada xasaasiga ah waa la diiwaan geliyay
• Door kasta waa la tijaabiyay, oo ay ku jiraan API-yada toosan iyo ID-yada la beddelay

Xakamaynta gelitaanka waa hal shay oo ka mid ah liis dheer; liiska amniga ee AI-ga lagu dhisay apps wuxuu daboolaa wixii kale. Haddii aad dhisayso qalab shaqaalahaaga gudaha ah, how to build an internal tool wuxuu muujinayaa halka doorarku ku habboon yihiin.

RBAC Mythex

Mythex ma bixiyo login ama nidaam door oo dhisan app-kaaga isticmaalayaasha. Waxaad dooranaysaa maktabad auth ama bixiye, oo waxaad sharraxdaa doorarka, agent-ku wuxuu ku xidhaa koodkaaga iyo database-ka Postgres ee mashruuca (add login to your app). Doorarka workspace-ka Mythex, sida Owner iyo Member, waxay xakameeyaan cidda tafatiri karta mashruucyada Mythex, ma aha cidda isticmaali karta app-ka aad publish gareysay. Isticmaal Plan mode si aad ugu heshiiso miiska ogolaanshaha ka hor intaadan dhisin, kadibna isticmaal prompt-ka dib u eegista kor ku xusan, oo tijaabi door kasta Preview ka hor publish. Security prompts ee dukumentiyada waa raad wanaagsan oo xiga.

Su'aalaha