┌──────────┐ ┌──────────────┐ ┌────────────┐ ┌──────────────┐ │ Mobile │───▶│ GitGuard API │───▶│ permitUtils│───▶│ Permit.io │ │ App │◀───│ │◀───│ middleware│◀───│ Cloud PDP │ └──────────┘ └──────────────┘ └────────────┘ └──────────────┘ │ ▲ │ │ └──────────────────────────────────────────────────────┘ Policies defined in Permit.io dashboard 

// Backend initialization (src/index.ts) export const permit = new Permit({ token: process.env.PERMIT_API_KEY || "", pdp: process.env.PERMIT_PDP_URL || "http://localhost:7766", }); 

// Permission check implementation (src/utils/permitUtils.ts) export const checkPermission = async ( userId: string, action: string, resource: string, resourceInstance?: string ) => { let resourceObj: string | { type: string; id: string } = resource; // If resource instance is provided, create resource object if (resourceInstance) { resourceObj = { type: resource, id: resourceInstance, }; } // Try to check permission with Permit.io first try { const permitted = await permit.check(userId, action, resourceObj); if (permitted) return true; } catch (permitError) { console.warn( `Permit check failed for user ${userId} on ${resource}:${resourceInstance} - ${permitError}` ); // Continue to fallback check } // If Permit.io check fails or returns false, fall back to database check if (resource === "repository" && resourceInstance) { const { prisma } = await import("../index"); // Check if user is the repository owner const repo = await prisma.repository.findUnique({ where: { id: resourceInstance }, select: { ownerId: true }, }); if (repo && repo.ownerId === userId) { return true; // Repository owners have all permissions } // Check role assignments const roleAssignment = await prisma.roleAssignment.findFirst({ where: { userId, repositoryId: resourceInstance, }, include: { role: { include: { permissions: true, }, }, }, }); if (roleAssignment) { // Check if the assigned role has the required permission const hasPermission = roleAssignment.role.permissions.some( (permission) => permission.action === action || permission.action === "admin" ); if (hasPermission) { return true; } } } return false; }; 

// Role assignment (src/utils/permitUtils.ts) export const assignRoleInPermit = async ( userId: string, roleKey: string, resourceType: string, resourceInstanceKey: string ) => { try { // First ensure the user exists in Permit.io try { await syncUserWithPermit(userId); } catch (userError) { console.warn(`Could not sync user with Permit.io: ${userError}`); // Continue anyway - we'll try to assign the role } await permit.api.roleAssignments.assign({ user: userId, role: roleKey, tenant: "default", resource_instance: `${resourceType}:${resourceInstanceKey}`, }); console.log( `Successfully assigned role ${roleKey} to user ${userId} for ${resourceType}:${resourceInstanceKey}` ); return true; } catch (error: any) { // If it's a 409 conflict (role already assigned), treat as success if (error.response && error.response.status === 409) { console.log( `Role ${roleKey} already assigned to user ${userId}, skipping` ); return true; } console.error("Failed to assign role in Permit.io:", error); // Don't throw the error, just log it and continue - this makes the app more resilient // We'll fall back to database checks for permissions return false; } }; 

// Usage in API endpoints (src/routes/repository.ts) router.get("/:id", authenticateJWT, async (req, res, next) => { try { const { id } = req.params; const userId = req.user.id; // Check permission with Permit.io const hasViewPermission = await checkPermission( userId, "view", "repository", id ); if (!hasViewPermission) { throw new ApiError( 403, "You don't have permission to view this repository" ); } // Proceed with repository retrieval... } catch (error) { next(error); } }); 

git clone https://github.com/nikhilsahni7/GitGuard.git cd GitGuard 

# Permit.io PERMIT_API_KEY=your_permit_api_key PERMIT_PDP_URL=http://localhost:7766 # Or cloud PDP URL # Database DATABASE_URL=postgresql://user:password@localhost:5432/gitguard # JWT Authentication JWT_SECRET=your_jwt_secret JWT_EXPIRES_IN=7d # GitHub Integration GITHUB_CLIENT_ID=your_github_client_id GITHUB_CLIENT_SECRET=your_github_client_secret # Push Notifications EXPO_ACCESS_TOKEN=your_expo_token 

# Backend setup cd backend bun install bun run db:migrate bun run permit:setup bun run dev # Mobile setup (in a separate terminal) cd ../mobile yarn install yarn start 

cd backend bun run permit:setup 

bun run permit:verify 

// Setup owner relation (setup-permit.ts) const relationData = { key: "owner", name: "Owner", subject_resource: "user", }; await permit.api.resourceRelations.create("repository", relationData); // Create relationship tuples for specific repositories await permit.api.relationshipTuples.create({ subject: `user:${userId}`, relation: "owner", object: `repository:${repositoryId}`, tenant: "default", }); 

export const checkPermission = async ( userId, action, resource, resourceInstance ) => { // Try Permit.io first try { const permitted = await permit.check(userId, action, resourceObj); if (permitted) return true; } catch (permitError) { // Log and continue to fallback } // Fallback to database check // [Database permission check logic omitted for brevity] }; 

// When approving access requests (routes/accessRequest.ts) await prisma.roleAssignment.create({ data: { userId: requestData.userId, repositoryId: requestData.repositoryId, roleId: requestData.roleId, expiresAt: new Date(Date.now() + duration), // Time-bound access approvedBy: adminId, approvedAt: new Date(), }, }); // Also register in Permit.io await assignRoleInPermit( requestData.userId, role.key, "repository", requestData.repositoryId ); // Background job runs to revoke expired access // [Scheduled job implementation omitted for brevity] 

// Mobile app generates a biometric token (mobile code) const biometricAuth = async () => { const compatible = await LocalAuthentication.hasHardwareAsync(); if (!compatible) { throw new Error("Biometric authentication not available"); } const result = await LocalAuthentication.authenticateAsync({ promptMessage: "Authenticate to approve access request", fallbackLabel: "Use passcode", }); if (result.success) { // Generate token only after successful biometric auth return generateBiometricToken(); } throw new Error("Authentication failed"); }; // Backend verifies token before approving (routes/accessRequest.ts) router.post("/:id/approve", authenticateJWT, async (req, res, next) => { try { const { biometricToken } = req.body; const adminId = req.user.id; // Verify biometric token const validToken = await verifyBiometricToken(adminId, biometricToken); if (!validToken) { throw new ApiError(401, "Invalid biometric verification"); } // Process approval with Permit.io // [Approval logic omitted for brevity] } catch (error) { next(error); } });