LioranDB TypeScript Series #8: Authentication, Users, Roles and Sessions

LioranDB TypeScript Series: Build with a developer-first document database powered by Rust and designed for TypeScript.

A database isn't production infrastructure if everyone connecting to it effectively becomes root.

LioranDB exposes authentication and authorization through the same TypeScript client.

Authentication

const login = await client.auth.login(
  "admin",
  "password"
);

The client also exposes session operations:

await client.auth.me();
await client.auth.listSessions();
await client.auth.refresh(refreshToken);
await client.auth.revokeSession(sessionId);
await client.auth.logout();
await client.auth.logoutAll();

Automatic token refresh

Configure:

const client = await LioranDBClient.connect(uri, {
  autoRefreshTokens: true,
});

The driver's token manager can then handle session refresh automatically.

Create a user

Administrative clients can use UsersService.

const user = await client.users.create({
  username: "analytics-user",
  password: "SuperStrongPassword123!",
  roles: ["read_only"],
  must_change_password: false,
});

Manage it:

await client.users.list();
await client.users.get(userId);

await client.users.update(userId, {
  enabled: true,
  metadata: {
    team: "analytics",
  },
});

await client.users.revokeSessions(userId);
await client.users.delete(userId);

Roles

Instead of scattering permissions directly across application logic, create roles.

const role = await client.roles.createRole({
  name: "readers",

  grants: [
    {
      permission: "DocumentRead",

      scope: {
        kind: "database",
        database: "default",
      },
    },
  ],
});

Permission scopes

Permissions can be scoped at different levels.

Cluster:

{
  kind: "cluster"
}

Database:

{
  kind: "database",
  database: "default"
}

Collection:

{
  kind: "collection",
  database: "default",
  collection: "users"
}

That gives you a useful building block for least-privilege application accounts.

Application pattern

Don't make every service use the administrator account.

For example:

Admin / Operations
    → administrative role

Backend API
    → application-specific read/write role

Analytics
    → read-only role

Backup worker
    → backup permissions

The fewer permissions a compromised credential has, the smaller your blast radius.

Resources

Auth & Admin Docs:
https://docs.liorandb.com/docs/driver/auth-and-admin

Documentation: https://docs.liorandb.com
Website: https://liorandb.com

---

Previous: Part 7 → Aggregation
Next: Part 9 → Cluster, Backups & Operational APIs