> For the complete documentation index, see [llms.txt](https://kinesis-school-of-programming.gitbook.io/nestjs-unleashed/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kinesis-school-of-programming.gitbook.io/nestjs-unleashed/extra-module-1-authentication-authorization/authorization.md).

# Authorization

The act of deciding whether or not a user is allowed to a resource.

Now, let's delve into **Authorization**. We'll use the **RBAC** model (role-based access control). As the name implies, what defines the permissions of a user in this model are his **role**(s). For example, a <mark style="color:blue;">`user`</mark> with the <mark style="color:blue;">`role`</mark> <mark style="color:blue;">admin</mark> may access any resource, whilst other users have a lower access clearance. There are other models that allow greater permission granularity, such as **ABAC** (attribute-based access control), but that won't be the focus here.

Let's imagine that our system will have three roles: <mark style="color:blue;">admin</mark>, <mark style="color:blue;">manager</mark> and <mark style="color:blue;">user</mark>. The <mark style="color:blue;">admin</mark> can access any resource, the <mark style="color:blue;">manager</mark> may manage products and categories, and the <mark style="color:blue;">user</mark> may see his own data, make orders and pay them. This is a summary, and not an exhaustive list.

We can also imagine the following scenario: an <mark style="color:blue;">admin</mark> account will have been created beforehand in a **migration**, with provisional login credentials, which will be transferred in confidence to the system contractor. From this account, it will be possible to grant privileges to other users, like becoming a <mark style="color:blue;">manager</mark> or even another <mark style="color:blue;">admin</mark>. And a regular <mark style="color:blue;">`user`</mark> may create his account in the usual way, which will, by default, have the <mark style="color:blue;">`role`</mark> <mark style="color:blue;">user</mark>.

Let's then begin.