https://linen.dev logo
Join Slack
Powered by
My flow is like. We have frontend, bff and microse...
# permit-saas
m
My flow is like. We have frontend, bff and microservice of auth service which has integrated permit.io. We have roles and permissions in permit.io. Now we will integrate the SSE for the events. Whenever we remove any permission from the permit.io the event need to be triggered and from that it need to go the frontend and it need to be reflected on that. For that I have to integrate the webhook because permit.io doesn't have a built in functionalities to create SSE instead of that in permit.io have a support to create webhook. But I don't know how to create and configure webhook for this use case. Eventough I am a workspace owner, I didn't see any options to configure webhook. Please help me with this.
a
Hi @Mithies Ponnusamy, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
p
Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?
a
Based on the documentation, webhooks in Permit.io are primarily available through the ​*Permit Elements*​ feature, which is designed for specific UI components rather than general permission change events (1) . Current Webhook Capabilities The webhooks documented are specifically for Permit Elements events : • User Management events (create user, invite user, assign role) • Access Request events • Operation Approval events These webhooks are configured within the Permit Elements setup, not as a general workspace feature . Setting Up Webhooks for Elements To configure webhooks, you need to : 1. ​*Create your webhook endpoint*​ that can receive POST requests 2. ​*Implement webhook handling*​ to parse the JSON payload 3. ​*Secure your endpoint*​ with HTTPS and a secret for validation 4. ​*Respond with 200 HTTP status*​ to acknowledge receipt Example webhook payload for role assignment :
Copy code
{  
 user_id: str  
 tenant_id: str  
 role: str  
 permission_level: str  
 type: ElementsWebhookType = "role_assignment"  
}
Alternative Approach for Your Use Case Since Permit.io doesn't provide built-in webhooks for general permission changes, you might need to: 1. Use the Permit.io API to poll for changes periodically 2. Implement your own change detection in your auth service 3. Create SSE events from your BFF when changes are detected For syncing users and roles, the documentation shows examples of using the Permit SDK to sync changes (2) , (3) :
Copy code
await permit.api.assignRole({  
 role: "admin",  
 tenant: "default",  
 user: email,  
}) ;
(2) If you need webhooks specifically for permission changes rather than Elements events, you may want to reach out to Permit.io support for additional options, as this functionality isn't documented in the available sources.
To learn more, see the sources I considered: [[1] Configure Webhooks](https://docs.permit.io/embeddable-uis/webhooks) [[2] Fine-Grained Authorization with Logto.io and Permit.io](https://docs.permit.io/authentication/logto) [[3] Auth0 and Permit Integration](https://docs.permit.io/authentication/auth0/permit-integration)
o
@Ask Inkeep got confused here. What you want is the PDP updates callback, which can trigger your backed to in turn send an event to your frontend. https://docs.permit.io/concepts/pdp/configuration/#pdp_data_update_callbacks
a
Thanks for tagging me @Or Weis. I'll look through relevant sources and get back to you shortly.
You're absolutely right! For your use case, you should use PDP data update callbacks to get notified when permissions change. PDP Data Update Callbacks The PDP supports callbacks that trigger after successful data updates (1) (2) . Here's how to configure them: Configuration Set these environment variables on your PDP :
Copy code
OPAL_SHOULD_REPORT_ON_DATA_UPDATES=True
(2)
Copy code
OPAL_DEFAULT_UPDATE_CALLBACKS={"callbacks":["<http://opal_server:7002/data/callback_report>"]}
You can configure multiple callback URLs or add custom headers :
Copy code
OPAL_DEFAULT_UPDATE_CALLBACKS={"callbacks":[("<http://opal_server:7002/data/callback_report>",{"headers":{"X-My-Token":"token"}}) ]}
How It Works When permissions change in Permit.io, the PDP receives the update and will : 1. Successfully apply the data update 2. Call your configured webhook endpoint 3. Your backend receives the callback 4. You can then trigger SSE events to your frontend The callback uses POST method with 
{"content-type": "application/json"}
headers by default . Alternative: Proxy Facts for Immediate Consistency If you need immediate consistency, consider using the proxy facts feature with 
proxy_facts_via_pdp=True
(3) . This ensures permission changes are immediately available:
Copy code
permit = Permit(
    token="<your-api-key>",
    pdp="<http://localhost:7766>",
    proxy_facts_via_pdp=True
)
This approach waits for data synchronization before returning, ensuring your frontend gets consistent permission data immediately after changes .
To learn more, see the sources I considered: [[1] Configurations](https://docs.permit.io/concepts/pdp/configuration) [[2] How to use data update callbacks and OPA healthcheck policy](https://docs.opal.ac/tutorials/healthcheck_policy_and_update_callbacks) [[3] Send Consistent Updates (Read-Your-Own-Writes)](https://docs.permit.io/how-to/manage-data/local-facts-uploader)
m
@Or Weis By doing this, I can configure the webhook and through that I can give the SSE event to frontend?
p
Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?
m
Also I need to get a user's policies and permission from the permit.io while login. We have a plan to get those policies and permission, through the SSE as well, is that possible, if that is possible, it need a same configuration for that as well?
a
Hey @Mithies Ponnusamy, will circle back to you soon!
o
1. Yes that is exactly what I suggested. 2. You can use getUserPermission, list roles or any of the other APIs to get the information you need. @Ask Inkeep please share the references for get user permissions and the other PDP APIs
a
Thanks for tagging me @Or Weis. I'll look through relevant sources and get back to you shortly.
Here are the references for getting user permissions and other PDP APIs: Get User Permissions The 
permit.getUserPermissions
function retrieves all user permissions across all registered resources and tenants (1) . This determines all user permissions for every registered resource across all tenants . Basic Usage Examples
Copy code
const { Permit } = require("permitio") ;  
  
const permit = new Permit({token: "<YOUR_API_KEY>", ...}) ;  
const userPermissions = await permit.getUserPermissions("<mailto:john@doe.com|john@doe.com>") ;
Copy code
import io.permit.sdk.Permit;  
import io.permit.sdk.PermitConfig;  
import io.permit.sdk.enforcement.*;  
import java.util.Arrays;  
  
  
Permit permit = new Permit(  
 new PermitConfig.Builder("[YOUR_API_KEY]") .build()  
) ;  
  
UserPermissions permissions = permit.getUserPermissions(  
 new GetUserPermissionsQuery(  
 User.fromString("<mailto:john@doe.com|john@doe.com>")  
 )  
) ;
Filtering Results You can filter by tenants, resource_types, or specific resources :
Copy code
const userPermissions = await permit.getUserPermissions(  
 "<mailto:john@doe.com|john@doe.com>",  
 ["tenant-1", "tenant-2"], // tenants  
 ["document:doc-1", "document:doc-2"] // resources  
 ["document", "__tenant"], // resource_types  
) ;
List Role Assignments (Local PDP API) The 
permit.pdp_api.role_assignments.list
function returns role assignments from the local PDP (2) . Available from PDP container version 
permitio/pdp-v2:0.3.0
and above .
Copy code
from permit.models.pdp import RoleAssignmentRead  
  
permissions: RoleAssignmentRead = permit.pdp_api.role_assignments.list() ;
Filter by User
Copy code
from permit.models.pdp import RoleAssignmentRead  
  
permissions: RoleAssignmentRead = permit.pdp_api.role_assignments.list(  
 user="John",  
)
Filter by Resource Instance
Copy code
from permit.models.pdp import RoleAssignmentRead  
  

permissions: RoleAssignmentRead = permit.pdp_api.role_assignments.list(  
 resource_instance_key="document:onboarding-doc",  
)
Additional Advanced Queries Bulk Check For checking multiple permissions in a single call (3) :
Copy code
const permitted = await permit.bulkCheck([
 { user: "<mailto:anna@smith.com|anna@smith.com>", action: "read", resource: "contract" },
 { user: "<mailto:anna@smith.com|anna@smith.com>", action: "create", resource: "document" },
 { user: "<mailto:john@walker.com|john@walker.com>", action: "sign", resource: "contract" },
 { user: "<mailto:jane@jarvis.com|jane@jarvis.com>", action: "authorize", resource: "invoice" },
]) ;
Get Authorized Users To retrieve users authorized for a specific action on a resource :
Copy code
from permit import AuthorizedUsersResult

authorized_users: AuthorizedUsersResult = permit.authorized_users(
 "read", "repo",
)
These APIs can be called directly from your local PDP to avoid network latency and provide faster responses (2) .
To learn more, see the sources I considered: [[1] Get user permissions](https://docs.permit.io/how-to/enforce-permissions/user-permissions) [[2] Local Enforcement APIs](https://docs.permit.io/how-to/enforce-permissions/list-role-assignments) [[3] Advanced Authorization Queries](https://docs.permit.io/overview/advanced-authorization-queries)
m
I am using the permit.io as a pdp container. I added the line # Local BFF callback configuration - OPAL_DEFAULT_UPDATE_CALLBACKS=http://host.docker.internal:8011/sse/pdp-update - OPAL_CALLBACK_SECRET=6aa0e5c02c727dec1f3fbe2ea1df535a686c78672e9a4983cf4d0d263a3f0b8f - OPAL_CALLBACK_SIGNATURE_HEADER=X-PDP-Signature - OPAL_CALLBACK_SIGNATURE_FORMAT=sha256={signature} I try to start the docker, but the permit_pdp container is crashing
a
Hey @Mithies Ponnusamy, can you share your pdp logs please
m
Untitled
Untitled
a
The PDP is expecting a JSON object with a 
callbacks
field. @Ask Inkeep Can you expand on that?
a
Thanks for tagging me @Alon Boshi. I'll look through relevant sources and get back to you shortly.
The issue is with the format of 
OPAL_DEFAULT_UPDATE_CALLBACKS
- it needs to be a JSON object with a 
callbacks
field containing an array (1) . The correct format should be:
Copy code
OPAL_DEFAULT_UPDATE_CALLBACKS={"callbacks":["<http://host.docker.internal:8011/sse/pdp-update>"]}
Or with custom headers:
Copy code
OPAL_DEFAULT_UPDATE_CALLBACKS={"callbacks":[("<http://host.docker.internal:8011/sse/pdp-update>",{"headers":{"Authorization":"Bearer token"}}) ]}
The PDP also supports the 
PDP_DATA_UPDATE_CALLBACKS
configuration which expects a JSON array format (2) :
Copy code
PDP_DATA_UPDATE_CALLBACKS=[{"url": "<http://example.com/callback>","key": "example","config": {"headers": {"Authorization": "Bearer token"},"method": "GET","data": {"key": "value"}}}]
The default config for callbacks is 
{"method": "POST"}
. For debugging this issue, could you share: 1. Which Workspace / Project / Env you are using 2. What calls you are performing (as SDK code or CURL) 3. Which PDP version you are running 4. The full PDP logs showing the crash
To learn more, see the sources I considered: [[1] How to use data update callbacks and OPA healthcheck policy](https://docs.opal.ac/tutorials/healthcheck_policy_and_update_callbacks) [[2] Configurations](https://docs.permit.io/concepts/pdp/configuration)
a
Copy code
docker run -it \
  -p 7766:7000 \
  --env PDP_API_KEY={your-api-key} \
  --env PDP_DEBUG=True \
  --env 'PDP_DATA_UPDATE_CALLBACKS=[{"url":{"your-webhoook"}]' \
  permitio/pdp-v2:latest
for example
m
Thank you
💜 1
I have done the callback method get the permission changing from the pdp logs for my SSE Stream integration, but the issue is it only sending the metadata. But I need the real data, so that in the frontend, we can reflect it.
o
You can fetch the data following the event from the control-plane API or the PDP.
m
Also thorugh the SSE integration. I need to get the policies and permission I have configured for the roles in my application. If the user is logged in, I need to get the policies and permission for that particular role with that SSE or the callback you've mentioned. Is that possible?
o
I’d suggest you do the data fetching in your backend and then send what you need over the SSE, or have the SSE event point your frontend to your backend to retrieve the needed information
m
Fetching from the backend is not a problem, but it took around 10 to 15 sec while I try to fetch the policies and permission from the permit.io sdk and api.
That's why we have planned to get those policies and permission for the particular user role from the pdp docker container we have in our service, because it stores the updated policies and permissions for a while right?
o
but it took around 10 to 15 sec while I try to fetch the policies and permission from the permit.io sdk and api
Which APIs are you calling? - this doesn’t sound likely
You can use the local facts PDP APIs - https://pdp-api.permit.io/redoc#tag/Local-Facts-API @Ask Inkeep
Open in Slack
PreviousNext
Powered by