Lab 8: Implement Access Control

Enda Lee 2025

PDF version

Getting Started

1. Clone or download this repository.
2. Open the application folder in VS Code.
3. Create a .env file in the application root using .env.example as a template.
4. Copy local.db.bak to local.db
5. In the terminal, run npm install to install dependencies.
6. Start the development server with npm run dev.

Overview

The applicaion is the completed Locations example from Week 5, with some changes:

1. Updated database, see the Drizzle schema and Zod validation- src/lib/server/db/.

2. The user table includes the following user accounts:

   username	password	role
   admin	Password	admin
   alice	Password	user
   bob	Password	user
   test	Password	user

3. Each user has their own set of locations, some of which are shared. The admin user can access everything. The following access control matrix defines access rules for each role.

   Action	User	Manager	Admin
   Authentication
   Login/Register	✅	✅	✅
   View own profile	✅	✅	✅
   Locations
   View own locations	✅	✅	✅
   View shared locations	✅	✅	✅
   View all locations	❌	✅	✅
   Create own locations	✅	✅	✅
   Edit own locations	✅	✅	✅
   Edit any location	❌	✅	✅
   Delete own locations	✅	✅	✅
   Delete any location	❌	✅	✅
   Categories
   View categories	✅	✅	✅
   Manage categories	❌	✅	✅
   User Management
   View user list	❌	❌	✅
   Change user roles	❌	❌	✅
   Delete users	❌	❌	✅

For full details and examples see the Lab 6 videos.

Exercise

1. Implement access control control, i.e. authentication and authorisation for this application. The rules should be based on the matrix above. This should be based on the examples from lab 6

Do it in stages:

1. Use hooks.server.ts to check for a session cookie.
2. Use the shared Layout to check for event.locals.user and pass it to the page (or redirect to login if required).
3. Group pages according to required access, e.g. public or private
4. Authorisation: Check that the current user has permission before retrieving/ displaying data. This should be checked in the view (pages) but also at the service layer - so check user before getting data.

The result does not need to look identical to the screencast video example (e.g. you may implement grouping differently), but the same methods should be used to implement security at each level.

Note: Some of the required code and functionality is already included in this example, some will need to be copied from the solution. It is up to you to figure this out and 'wire it up' correctly.

2. Verify that the access rules implement the rules defined in the matrix.

---

Enda Lee 2025