{"action":"created","issue":{"url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/158","labels_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/158/labels{/name}","comments_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/158/comments","events_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/158/events","html_url":"https://github.com/lynndylanhurley/devise_token_auth/issues/158","id":58286236,"number":158,"title":"Add role based authorization","user":{"login":"nicolas-besnard","id":1261670,"avatar_url":"https://avatars.githubusercontent.com/u/1261670?v=3","gravatar_id":"","url":"https://api.github.com/users/nicolas-besnard","html_url":"https://github.com/nicolas-besnard","followers_url":"https://api.github.com/users/nicolas-besnard/followers","following_url":"https://api.github.com/users/nicolas-besnard/following{/other_user}","gists_url":"https://api.github.com/users/nicolas-besnard/gists{/gist_id}","starred_url":"https://api.github.com/users/nicolas-besnard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nicolas-besnard/subscriptions","organizations_url":"https://api.github.com/users/nicolas-besnard/orgs","repos_url":"https://api.github.com/users/nicolas-besnard/repos","events_url":"https://api.github.com/users/nicolas-besnard/events{/privacy}","received_events_url":"https://api.github.com/users/nicolas-besnard/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-19T23:17:25Z","updated_at":"2015-02-19T23:33:49Z","closed_at":null,"body":"I know this is not the purpose of this gem, but if you had to implement it to work with `ng-token-auth`, how would you do that ?\r\n\r\nI'm working on a project based on this Gem, and I will need authorization for the iOs / Android app and later, the website."},"comment":{"url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/comments/75161993","html_url":"https://github.com/lynndylanhurley/devise_token_auth/issues/158#issuecomment-75161993","issue_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/158","id":75161993,"user":{"login":"lynndylanhurley","id":468037,"avatar_url":"https://avatars.githubusercontent.com/u/468037?v=3","gravatar_id":"","url":"https://api.github.com/users/lynndylanhurley","html_url":"https://github.com/lynndylanhurley","followers_url":"https://api.github.com/users/lynndylanhurley/followers","following_url":"https://api.github.com/users/lynndylanhurley/following{/other_user}","gists_url":"https://api.github.com/users/lynndylanhurley/gists{/gist_id}","starred_url":"https://api.github.com/users/lynndylanhurley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lynndylanhurley/subscriptions","organizations_url":"https://api.github.com/users/lynndylanhurley/orgs","repos_url":"https://api.github.com/users/lynndylanhurley/repos","events_url":"https://api.github.com/users/lynndylanhurley/events{/privacy}","received_events_url":"https://api.github.com/users/lynndylanhurley/received_events","type":"User","site_admin":false},"created_at":"2015-02-19T23:33:49Z","updated_at":"2015-02-19T23:33:49Z","body":"My current approach has been as follows:\r\n\r\n1. Return a list of roles / permissions with the `user` object on validation. This will look something like this in the `$auth.user` object:\r\n    \r\n    ~~~javascript\r\n    {\r\n      id: 1,\r\n      // ...\r\n      permissions: {\r\n        // ...\r\n        applications: {\r\n          view: true,\r\n          edit: false,\r\n          destroy: false\r\n        },\r\n        // ...\r\n    }\r\n    ~~~\r\n\r\n2. Define a permissions service on the client can check the user's permission object to determine their access to views / actions. This will look something like this when used in a template:\r\n\r\n    ~~~html\r\n    <ul>\r\n      <!-- ... -->\r\n      <li ng-show=\"hasPermission('applications', 'view')\">\r\n        <a ui-sref='user.applications'>Applications</a>\r\n      </li>\r\n      <!-- ... -->\r\n    </ul>\r\n    ~~~\r\n\r\n3. This is important - access to resources must be limited on the API as well as the client. We're using [pundit](https://github.com/elabs/pundit) for this.\r\n\r\nThis has been working for me in my apps, but I'm not sure if it can be generalized for every use case."}}