2020
Casting Agency API
Role-based access control across three permission tiers
Problem
A casting agency needs different staff to have different levels of access to the same data — an assistant shouldn't be able to delete a movie, but a producer needs full control. That's a real RBAC problem, not just an auth checkbox.
Architecture
Flask REST API over PostgreSQL (SQLAlchemy models for Actors/Movies), with Auth0 issuing JWTs that carry a permissions claim. Each endpoint checks for the specific permission it needs (e.g. `delete:movies`) rather than just checking whether a token is valid.
Key decisions
- —Permission-per-endpoint rather than role-per-endpoint — a token either carries `patch:actors` or it doesn't, so adding a fourth role later wouldn't require touching route code.
Still being written up
The original Heroku demo is long gone, so this is redeployed on Vercel + Neon Postgres. The root route and the RBAC gate itself are live and testable — hitting /actors or /movies without a token correctly returns a 401, which is the point. Getting a valid token requires an Auth0 login flow this demo doesn't expose publicly.