Build a Bitwise Permission System
Tags: javascript, webdev, tutorial, security
Published: 2022-10-20 06:00:00

Permissions are _everywhere_ and very _important to secure_ your application from unauthorized actions and potential data loss.
A system to handle and combine permissions can be overwhelming and maybe too complex, but there's a better way called 🔐 **Bitwise Permission System**!

- [🛠 How to build your own](#how-to-build-your-own)
- [📍 Where can you use them](#where-can-you-use-them)

## 🛠 How to build your own
I will be doing this in **JavaScript** but the system is pretty much in every language possible.

### Operators
Let's quickly discuss the **bitwise operators**. I'll give you a small overview here.

Bits is the unit `0` or `1`. It's the smallest unit of data a computer can process and store.
For example you can convert the number 3 into bits which would be `110`. I'm not going any deeper on bits, there's a lot of resources in the internet.

| Example       |  Operator | Name | Description                     |
| ------------- | --------- | ---- | ------------------------------- |
| 1100 & 0100 = 0100 | &       | AND  | Sets bit to 1 if **both** are 1 |
| 1100 &#124; 1000 = 1100 | &#124;      | OR  | Sets bit to 1 if **one** is 1 |
| 0100  1010 = 1110 | ^      | XOR  | Sets bit to 1 if **only one** is 1 |
| ~0110 = 1001 | ~      | NOT  | Invert each bit |

We are going to build a small project to check if a person is allowed to enter different areas in our headquarter.

First create our permissions for each area.
```js
const DEFAULT = 1 // 0001
const LABORATORY = 2 // 0010
const CAFE = 4 // 0100
const PARK = 8 // 1000
```

Next let's create three different users and give them some unique permissions. **Do not use addition only OR operator!** (Thanks to @naveennamani for correcting me)
```js
const Elen = DEFAULT | CAFE // 0101
const Carl = DEFAULT | LABORATORY // 0011
const Jenny = DEFAULT | CAFE | PARK // 1101
```

Here quickly some operations to change a person's permissions.
```js
let Naveen = DEFAULT;
Naveen |= PARK; // add permission
Naveen ^= LABORATORY; // toggle permission
Naveen &= (~PARK); // remove permission
console.log(Naveen);  // 0011 (DEFAULT and LABORATORY)
```

To check where each person has permission to access too we'll create a function that should return us an object with true or false for each area.
```js
function checkPermissions(person) {
  // Default if you have no permissions
  var permissions = {
    default: false,
    laboratory: false,
    cafe: false,
    park: false,
  }

  // Person can enter the building
  if(person & DEFAULT) {
    permissions.default = true
  }
  
  // Person can enter the laboratory
  if(person & LABORATORY) {
    permissions.laboratory = true
  }

  // Person can enter the cafe
  if(person & CAFE) {
    permissions.cafe = true
  }

  // Person can enter the park
  if(person & PARK) {
    permissions.park = true
  }

  // Return permissions of this person
  return permissions
}
```

To check if this worked let's print out the permissions of each persons.
```js
const permsOfElen = checkPermissions(Elen)
console.log("Permissions of Elen: ", JSON.parse(permsOfElen))

const permsOfCarl = checkPermissions(Carl)
console.log("Permissions of Carl: ", JSON.parse(permsOfCarl))

const permsOfJenny = checkPermissions(Jenny)
console.log("Permissions of Jenny: ", JSON.parse(permsOfJenny))
```

And here we have the correct output:
```json
"Permissions of Elen: ", {
  default: true, // <--
  laboratory: false,
  cafe: true, // <--
  park: false
}
"Permissions of Carl: ", {
  default: true, // <--
  laboratory: true, // <--
  cafe: false,
  park: false
}
"Permissions of Jenny: ", {
  default: true, // <--
  laboratory: false,
  cafe: true, // <--
  park: true // <--
}
```

Here's the [Code](https://gist.github.com/JannisMilz/26938b1da968c2e73776958e37947d6f)!

## 📍 Where can you use them
You can use bitwise permission systems in every application. It's fast because of binary and very easy to implement. Also the scalability of this system is to so easy and almost to infinite or let's say until you reached the limit of your datatype 😉.

You can use bitwise also for a role-based permission system where you give a role multiple permissions and then maybe only check for the role and not each permission 🤷‍♂️.

Me at [AquaHubStudio](https://dev.to/jannisdev/the-beginning-of-my-journey-516d) will use this system in every application to authorize certain actions. Follow me on my journey of AquaHub!

## 🔥 Last words
**Thanks for reading!**
Don't hesitate to comment on tips or problems. I will respond to every comment with joy.

<a href="https://www.buymeacoffee.com/jannisdev" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/default-blue.png" alt="Support me" height="20" width="80"></a>