How to check that a person has a specific role?

[nelsonic]

I would really like to make the role checking as declarative as possible so that the code is easier to read.
e.g:

RBAC.has_role(person, "admin") 

Using strings has advantages for readability and programatic use e.g. with a variable in place of the String:

RBAC.has_role(person, required_role) 

However, an empty string always matches: https://hexdocs.pm/elixir/String.html#contains?/2

iex> String.contains?("elixir of life", "")
true
iex> String.contains?("elixir of life", ["", "other"])
true

So if the required_role variable was set to "", the person would magically have admin access because the String.contains?/2 check would be true!! 🤦 i.e. trivial https://en.wikipedia.org/wiki/Privilege_escalation

To get around this, we could use atoms:

RBAC.has_role(person, :admin) 

Which consume memory for each role name, but it also makes it safe.
But since atoms cannot be "empty", we mitigate the empty string attack.

How about we accept both String and Atom for flexibility but have an immediate false if the String is empty?
What other security checks do we need to perform on this "potentially malicious" data?

Todo

• Create a function that checks that a person has a given role

• What else?

[nelsonic]

Included in #7 ✅