SAAS Feature Flag access control

[antonioberetini]

Hey everyone. We are building a robust SAAS product here at Get Local Inc. and we are currently working the access control logic for our app before going live. We managed to get the standard logic in place, to control logged in user, super admin public and similar. We are now working on merchant level access logic. For example, our pricing logic is based on predefined packages, where each package contains what we call feature flags. Each feature flag enables certain functionality.

For instance, a merchant subscribed to package 2x which includes 3 feature flags. Each user within that merchant hierarchy should see features related to those flags when logged in.

What is the most optimal way to implement this? Our user interface elements would have to hide and show depending on these future flags.

[BenoitRanque]

There are multiple valid approaches to solving this problem.
You could defined specific roles for each type of user, and restrict functionality based on those.

Alternatively, you could use _exists clauses in your permissions to only allow access to a resource if a record exists indicating user has access to a certain role/flag. Since those flags are records in a table, you an query them for the front end to know what UI to display or hide.

I'm sure there are other ways too, but we would have to know more about your schema to see if they are applicable.

[dsandip]

@antonioberetini Tagging for better visibility.