A standalone course · Catch up on this repo + interview prep
Authentication & Authorization, from newcomer to interview-ready
How this platform answers the two questions — "who are you?" and "what may you do?" — from a JWT in the metadata to a tenant-isolated row in Postgres.
Every request that reaches your data passed through a gauntlet of gates: a JWT
verified against a key set, a role check, a granular permission
scoped to a slice of the location tree, and finally Row-Level
Security in the database that filters rows by organization. This course
walks that whole chain, grounded in the real code where it's defined — the auth interceptor,
Shamir the token authority, rbacDecider, the permission/role model,
access_paths, and the RLS policies. It's the most security-critical machinery in the
repo, and among the most interviewable.
Part 1 — Authentication: who are you? available now
The token, where it comes from, and how every request proves identity.
1 · The two questions & the map
authN vs authZ, the gate sequence, and the three tiers of authorization.
ready2 · The JWT & its claims
The token format and the Manabie claim that carries identity + tenant.
3 · Shamir — the token authority
Login → exchange → mint, and the JWKS every service verifies against.
ready4 · The auth interceptor
Verify on every RPC, set the claims, and the two bypass lists.
readyPart 2 — Authorization: roles, permissions, locations available now
The three-tier "what may you do?" — from a coarse role to a permission scoped to a place.
5 · RBAC — the role gate
rbacDecider semantics (and the startup-panic myth), the role list.
6 · The granular permission model
permission → role → user_group → user, and the granted_permissions view.
7 · Locations & access_paths
The location tree, the materialized path, and subtree scoping.
ready8 · Scoped authorization in action
Resolving a permission to granted locations; the LocationRestricted gate.
Part 3 — Row-Level Security & the whole chain available now
The last gate — tenancy in the database — and the full request traced through all of them.
9 · RLS & multi-tenancy
resource_path, setPostgres, permission_check, FORCE RLS.
10 · Location-aware RLS policies
Tenant + app.user_id + granted permissions, enforced in the DB.
11 · Defense in depth — the full trace
One request through every gate; what each layer catches that others miss.
ready12 · rls_scan, service-to-service & recap
The drift scanner, faked JWTs, the surprises — and the whole-course recap.
readyPart 4 — Senior auth & authz new
The senior stretch — trust boundaries, verifier failure modes, authz-model design, debugging, service-to-service identity, and interview-grade answers.
13 · Token exchange & trust boundaries
Why Shamir is really an identity translator, not just a token machine.
new14 · Multi-issuer verification
JWKS rotation, issuer sets, and the operational side of token verification.
new15 · Designing authorization models
Why this repo uses roles, permissions, location scope, and RLS together.
new16 · Debugging auth failures
A senior debugging order for auth/authz failures under pressure.
new17 · Service-to-service auth
Fake JWT context, delegated scope, and the confused-deputy risk.
new18 · Senior interview questions
High-signal questions with the right answer shape.
new19 · Mock senior interview pack
A retrieval-first mock round with scoring and strong answer points.
newReference shelf
Cheat sheet
The gate sequence, the join chain, RLS functions + interview one-liners.
Glossary
The canonical vocabulary, mapped to interview terms.
Repo auth map
Ground truth: interceptor, Shamir, rbacDecider, permissions, locations, RLS — with file:line.
Resources
RFCs, OIDC, Postgres RLS, NIST RBAC, Firebase — plus senior auth topics.
Senior backend playbook
The compressed version of the new senior part: trust boundaries, verifier failure modes, authz design, debugging, service-to-service auth, and interview answers.