Auth0订阅计划app_metadata

Question

I'm developing a quiz app which requires authorization for only-subscribed members can see.

How to do that? I'm thinking of putting metadata (is_subscribed) to true for subscribed member and give the scope so he/she can gain permissions.

But, I don't know how to do it. Please help. The docs is so confusing

Answer 1

There are two separate concerns here.

• Where to keep the subscription information. app_metadata is fine, or you might choose to do so in a backend database (application specific). A client application will probably handle subscriptions and be in charge of updating that value. If you store the value in app_metadata , you will use Management API v2 to alter the user profile from the application that handles subscriptions.

• Add an authorization scope based on the subscription status. In this case, you would use a rule to add a custom scope based on the value of the is_subscribed field. Ie:

function(user, context, callback) {
  if (user.app_metadata && user.app_metadata.is_subscribed) {
    context.accessToken.scope = ['read:quiz'];
  } else {
    // remove the ability to read a quiz if not subscribed.
    context.accessToken.scope = [];
  }
  callback(null, user, context);
}

If you decided to store the subscription information in a backend database instead of in the app_metadata , you would simply access the database from the rule in the above code.