FusionAuth and Permit Example

Use the Permit.io and FusionAuth example repository to see one way to sync FusionAuth users into Permit and check their permissions. This page is for developers who use FusionAuth and want a reference implementation before they write their own handoff code. It describes what the example contains. It is not a step-by-step integration guide.

For the general integration steps that apply to any provider, see Connect your authentication.

What the example repository contains

The permit-x-fusionauth repository has two applications and a shared configuration file:

Folder	What it runs	Role in the integration
server/	An Express server	Handles FusionAuth sign-in and sign-out, receives the FusionAuth user creation webhook, syncs users to Permit, and checks permissions
client/	A React app built with webpack	Signs the user in through the server and requests actions that the server checks with Permit
config.js	Shared settings	FusionAuth client ID, client secret, API key, and the ports for the client, server, and FusionAuth

How the example connects FusionAuth to Permit

1. Sign-in. The server's login and oauth-callback routes run the FusionAuth OAuth flow with PKCE (Proof Key for Code Exchange) and store the user's token in the session.
2. User sync. FusionAuth calls the server's /sync-user route through a webhook when a user is created. The route reads the user's id and email and syncs the user to Permit with that id as the user key. The route assigns the friend role to @fusionauth.io and @permit.io email addresses, and the stranger role to every other address, in a tenant with the key FusionAuth.
3. Permission check. The server's /permit route calls permit.check() with the requested action, a resource type in the FusionAuth tenant, and the sub value from the userData object that the client sends in the request body. The route returns HTTP 200 when Permit allows the action and HTTP 403 when Permit denies it.

To run the example against your own accounts, your Permit environment needs a FusionAuth tenant, the friend and stranger roles, and a card resource with the view-personal-info and view-gpg-key actions. The client checks those two actions on the card resource.

Adapt the example to your application

Replace the credentials in the example

The repository stores a FusionAuth client secret and API key in config.js, and a Permit API key in server/routes/permit.js and server/routes/sync-user.js. Replace these values with your own, and load them from environment variables. Anyone who can read a committed API key can use it against your environment.

The example uses an early version of the Permit Node.js SDK (permitio 0.0.5). The permit.write() wrapper and the roles field inside syncUser() are not part of the current SDK. When you copy the pattern into your application:

• Sync the user with permit.api.syncUser(), as shown in Sync users.
• Assign the role in a separate call, as shown in the Node.js assignRole reference.
• Check permissions with permit.check(), as shown in Check permissions. Read the user key from the verified session on the server, not from the request body. A client can put any user key in a request body.

Watch the example in a webinar

The webinar recording below walks through the example application.

Next steps

• How authentication connects to Permit.io: the handoff point and the user key.
• Sync users: sync users with the current SDKs.
• Check permissions: enforce your policy in the backend.