Implement role-based access control for Flexport integrations. Since Flexport API keys are scoped at the account level, RBAC is implemented in your application layer with per-role API key allocation and request filtering.
type Role = 'viewer' | 'operator' | 'finance' | 'admin';
const ROLE_PERMISSIONS: Record<Role, { methods: string[]; paths: RegExp[] }> = {
viewer: {
methods: ['GET'],
paths: [/^\/shipments/, /^\/products/, /^\/purchase_orders/],
},
operator: {
methods: ['GET', 'POST', 'PATCH'],
paths: [/^\/shipments/, /^\/bookings/, /^\/purchase_orders/, /^\/products/],
},
finance: {
methods: ['GET'],
paths: [/^\/freight_invoices/, /^\/commercial_invoices/, /^\/shipments/],
},
admin: {
methods: ['GET', 'POST', 'PATCH', 'DELETE'],
paths: [/.*/],
},
};
function checkPermission(role: Role, method: string, path: string): boolean {
const perms = ROLE_PERMISSIONS[role];
return perms.methods.includes(method) && perms.paths.some(p => p.test(path));
}
function rbacMiddleware(role: Role) {
return (req: Request, res: Response, next: NextFunction) => {
const flexportPath = req.params.flexportPath;
if (!checkPermission(role, req.method, `/${flexportPath}`)) {
return res.status(403).json({ error: 'Insufficient permissions' });
}
next();
};
}
interface TenantConfig {
tenantId: string;
flexportApiKey: string;
role: Role;
allowedShipmentPrefixes?: string[];
}
class MultiTenantFlexport {
private configs: Map<string, TenantConfig>;
async request(tenantId: string, path: string, options: RequestInit = {}) {
const config = this.configs.get(tenantId);
if (!config) throw new Error('Unknown tenant');
if (!checkPermission(config.role, options.method || 'GET', path)) {
throw new Error('Permission denied');
}
return fetch(`https://api.flexport.com${path}`, {
...options,
headers: {
'Authorization': `Bearer ${config.flexportApiKey}`,
'Flexport-Version': '2',
'Content-Type': 'application/json',
},
}).then(r => r.json());
}
}
async function auditLog(entry: {
userId: string;
role: Role;
action: string;
resource: string;
result: 'allowed' | 'denied';
}) {
await db.auditLogs.create({
data: { ...entry, timestamp: new Date(), ip: req.ip },
});
logger.info(entry, 'RBAC audit');
}
