Frontend

Change to the 'frontend/react' folder.

Copy the '.env.example' file to a new file called '.env.development' and paste the following code into it:

REACT_APP_CERBERUS_API_HOST=https://cerberus-api.a11n.io
REACT_APP_CERBERUS_WS_HOST=wss://cerberus-ws.a11n.io

These are react variables we'll use later.

Next, you'll need to install the cerberus library. Run:

npm install @a11n-io/cerberus-reactjs

Now, in the 'src/index.js' file, change the code to the following:

import {CerberusProvider} from "@a11n-io/cerberus-reactjs";

const root = ReactDOM.createRoot(document.getElementById('root'));
root.render(
  <CerberusProvider apiHost={process.env.REACT_APP_CERBERUS_API_HOST} socketHost={process.env.REACT_APP_CERBERUS_WS_HOST}>
      <AuthProvider>
          <App />
      </AuthProvider>
  </CerberusProvider>
);

This sets up the cerberus context for the rest of the app.

In the 'src/hooks/useFetch.js' file, change the code to the following:

.
.
.
const authCtx = useContext(AuthContext)
const cerberusCtx = useContext(CerberusContext)

const defaultHeaders = {
    "Content-Type": "application/json",
}

let hdrs = defaultHeaders
if (authCtx.user) {
    hdrs = {
        ...hdrs,
        "Authorization": "Bearer " + authCtx.user.token,
        "CerberusAccessToken": cerberusCtx.apiTokenPair.accessToken,
        "CerberusRefreshToken": cerberusCtx.apiTokenPair.refreshToken
    }
}
.
.
.

This will ensure the cerberus access token and refresh token is added to every request.

But we haven't yet populated the context, so the tokens are empty.

To do this, change the 'src/context/AuthContext.js' file:

.
.
.
const cerberusCtx = useContext(CerberusContext)

const [user, setUser] = useSessionStorageState(`acme-user`, {defaultValue: null});

const logout = () => {
    setUser(null)
    cerberusCtx.setApiTokenPair(null)
}

const login = (user) => {
    setUser(user)
    cerberusCtx.setApiTokenPair(user.cerberusTokenPair)
}
.
.
.

Now, every time the user logs in, the cerberusTokenPair passed from the backend is stored in the AuthContext, and passed along in the headers with every request.

At this stage we have a fully working and permissioned app, and you can run it.

However, as a bonus feature, the cerberus react library also includes a websocket link with the cerberus API for realtime permission checks on the frontend.

This allows the frontend to pre-emptively respond to the permissions of a user and only show the elements they have access to.

To this end, there are two components available

• an AccessGuard component that shows child elements if the user has the required permissions

• a useAccess hook that returns a boolean for the required permissions

Next, we'll implement just that.