Quick question, with respect to role and permission validation can we create a custom validator in overrideGlobalClaimValidators?

Hey @doraig yea you can.

For node sdk

okay. And what's the behaviour you want for the claim? For example, from where is the claim value fetched and how often should it be refreshed?

Claim details are part of JWT payload, so was think of using OPA check against the user attribute

So you can build your own claim validator to use in overrideGlobalClaimValidators:

ts
import { SessionClaimValidator } from "supertokens-node/recipe/session"
import UserRoles from "supertokens-node/recipe/userroles";

let MyCustomClaimValidator: (runOPARule: (roles: string[]) => Promise<boolean>, maxAgeInSeconds?: number) => SessionClaimValidator = (runOPARule, maxAgeInSeconds) => {
    return {
        ...UserRoles.UserRoleClaim.validators.excludes("", maxAgeInSeconds),
        validate: async (payload: any, userContext: any): Promise<ClaimValidationResult> => {
            let roles = UserRoles.UserRoleClaim.getValueFromPayload(payload);
            if (roles === undefined) {
                return {
                    isValid: false,
                    reason: {
                        "message": "No roles in the session claim"
                    }
                }
            }
            let isValid = await runOPARule(roles)
            if (!isValid) {
                return {
                    isValid: false,
                    reason: {
                        "message": "Failed OPA check"
                    }
                }
            }
            return {
                isValid: true
            }
        }
    }
}

verifySession({
    overrideGlobalClaimValidators: (globalClaimValidators) => {
        return [...globalClaimValidators,
        MyCustomClaimValidator(async (roles) => {
            // TODO: define OPA check
            return true;
        })]
    }
})