acl := TeaACL new
    addRole: #admin;
    addRole: #superadmin;
    addResource: '/documents';
    "it supports good ol' Teapot route globs"
    addResource: '/documents/<id>';
    "privileges could pretty much be anything suiting your needs - it's definitely not limited to HTTP verbs"
    allowRole: #admin toAccess: '/documents' withPrivileges: #(POST GET);
    allowRole: #admin toAccess: '/documents/<id>' withPrivileges: #(GET PUT DELETE);
    "it supports a shortcut to allow everything for a given role"
    allowRole: #superadmin toAccess: '*' withPrivileges: #(GET).

...

"returns true"
acl checkRole: #admin toAccess: '/documents?foo=bar&bar=baz' withPrivilege: #GET.
"superadmin is the god here. returns true"
acl checkRole: #superadmin toAccess: '/foo/bar' withPrivilege: #GET.
"nobody is allowed to access a route not matching to any glob. returns false"
acl checkRole: #admin toAccess: '/xxx' withPrivilege: #GET.
"a user with undeclared role is not allowed to access this. returns false"
acl checkRole: #outsider toAccess: '/documents' withPrivilege: #GET.

Metacello new
    baseline: 'TeapotACL';
    repository: 'github://radekbusa/Teapot-ACL';
    load.

teapot before: '*' -> [ :req | middleware checkAuthorization: req ];

| token userRole requestUri |
	
token := self getToken: aRequest.
userRole := token payload at: #role. "To be modified. User role is stored in a JSON Web Token in this scenario."
requestUri := aRequest uri asString.

"Config>>ACL contains a preconfigured TeaACL instance."
(config ACL checkRole: userRole toAccess: requestUri withPrivilege: aRequest method) ifFalse: [
	aRequest abort: (TeaResponse code: 403).
].