title: Best practices for similar RBAC schemas?
body: <p>I all, I'm writing a boilerplate for future projects. Composition is as follows:</p>
  <p>Server:
  Express,
  Prisma 2,
  Typescript,
  JWT Auth (Access token in memory, Refresh in cookie)
  MySQL</p>
  <p>I'm writing an RBAC schema, and have successfully written express middlewares to determine if a user is logged in, and for if a user has a specific permission on their role.</p>
  <p>If you've ever used any of the minecraft server permission plugins, I'm trying to emulate the common pattern used there.</p>
  <ul>
  <li>Users have role(s)</li>
  <li>Roles have permissions</li>
  <li>Roles can inherit permissions from one or more roles</li>
  <li>Roles have a &quot;nextRole&quot; field to determine what role to give when the &quot;promote&quot; event is triggered.</li>
  </ul>
  <p>Everything works fine on the server side.</p>
  <p>What I'm wondering about is, how should I go about copying the middlewares (login, permissions) to the client side, and how should I determine whether a user has permission to do something?</p>
  <p>What I've looked at:</p>
  <ul>
  <li>Creating a &quot;hasPermission&quot; endpoint wouldn't be very good as I'd need to make an API call every time a permission check is needed.</li>
  <li>Eager loading all roles and permissions from the api when logging in and returning them in the response (I can't eager load the recursive role inheritance/nextRole as far as I know)</li>
  <li>Returning ONLY the user without roles and permissions for the JWT/login bit and getting roles/permissions from their own endpoints (again, needs to be recursive to get all inheritance and said permissions from inheritance)</li>
  </ul>
  <p>Has anyone created an RBAC schema like this, and how did you go about checking permissions on the client side without being too redundant/using too much memory/too many api calls?</p>