{"action":"closed","issue":{"url":"https://api.github.com/repos/ParabolInc/action/issues/70","repository_url":"https://api.github.com/repos/ParabolInc/action","labels_url":"https://api.github.com/repos/ParabolInc/action/issues/70/labels{/name}","comments_url":"https://api.github.com/repos/ParabolInc/action/issues/70/comments","events_url":"https://api.github.com/repos/ParabolInc/action/issues/70/events","html_url":"https://github.com/ParabolInc/action/issues/70","id":161792221,"number":70,"title":"RFC Add roles to JWT","user":{"login":"mattkrick","id":5514175,"avatar_url":"https://avatars.githubusercontent.com/u/5514175?v=3","gravatar_id":"","url":"https://api.github.com/users/mattkrick","html_url":"https://github.com/mattkrick","followers_url":"https://api.github.com/users/mattkrick/followers","following_url":"https://api.github.com/users/mattkrick/following{/other_user}","gists_url":"https://api.github.com/users/mattkrick/gists{/gist_id}","starred_url":"https://api.github.com/users/mattkrick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattkrick/subscriptions","organizations_url":"https://api.github.com/users/mattkrick/orgs","repos_url":"https://api.github.com/users/mattkrick/repos","events_url":"https://api.github.com/users/mattkrick/events{/privacy}","received_events_url":"https://api.github.com/users/mattkrick/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ParabolInc/action/labels/pr%20review","name":"pr review","color":"006b75"}],"state":"closed","locked":false,"assignee":{"login":"jordanh","id":103000,"avatar_url":"https://avatars.githubusercontent.com/u/103000?v=3","gravatar_id":"","url":"https://api.github.com/users/jordanh","html_url":"https://github.com/jordanh","followers_url":"https://api.github.com/users/jordanh/followers","following_url":"https://api.github.com/users/jordanh/following{/other_user}","gists_url":"https://api.github.com/users/jordanh/gists{/gist_id}","starred_url":"https://api.github.com/users/jordanh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jordanh/subscriptions","organizations_url":"https://api.github.com/users/jordanh/orgs","repos_url":"https://api.github.com/users/jordanh/repos","events_url":"https://api.github.com/users/jordanh/events{/privacy}","received_events_url":"https://api.github.com/users/jordanh/received_events","type":"User","site_admin":false},"assignees":[{"login":"jordanh","id":103000,"avatar_url":"https://avatars.githubusercontent.com/u/103000?v=3","gravatar_id":"","url":"https://api.github.com/users/jordanh","html_url":"https://github.com/jordanh","followers_url":"https://api.github.com/users/jordanh/followers","following_url":"https://api.github.com/users/jordanh/following{/other_user}","gists_url":"https://api.github.com/users/jordanh/gists{/gist_id}","starred_url":"https://api.github.com/users/jordanh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jordanh/subscriptions","organizations_url":"https://api.github.com/users/jordanh/orgs","repos_url":"https://api.github.com/users/jordanh/repos","events_url":"https://api.github.com/users/jordanh/events{/privacy}","received_events_url":"https://api.github.com/users/jordanh/received_events","type":"User","site_admin":false}],"milestone":null,"comments":2,"created_at":"2016-06-22T21:34:53Z","updated_at":"2016-06-28T07:33:43Z","closed_at":"2016-06-28T07:33:43Z","body":"## Issue - Enhancement\r\n\r\nIt makes sense to keep team-based permissions out of the JWT to keep it lightweight, but we should add in some app-level permissions.\r\nI'm proposing a `rol` field inside the JWT (protocol is to keep a field limited to 3 chars). By default, it will not be included. But if it is, it could have the following values:\r\n- `su`: superuser. can visit the `/graphql` page and email templates that @ackernaut is setting up. Can query and mutate entities that do not belong to it. Given to parabol employees. Certain sensitive items, like the `inviteToken` are still hidden via graphql & require direct DB access.\r\n\r\nBy including this in the token, we don't have to hit the database to check for admin privileges on every single query. This is useful for a query like `getTeamById` where we only want to return a value if the person is a member of that team OR if they are a parabol employee.\r\n\r\nBy using `su` as the value, we save 2 characters compared to using `true`, plus it allows us to add in more roles later, for instance, maybe certain employees can only view credit card info...\r\n\r\n**Estimated effort:** 1 point ([see CONTRIBUTING.md](https://github.com/ParabolInc/action/blob/master/CONTRIBUTING.md#points-and-sizes))"}}
{"actor":{"display_login":"jordanh"}}