title: setting permissions on redux actions
body: <p>I am creating a web redux-react app which will have a number of different permission levels. Many users may be interacting with one one piece of data but some may have limitations on what they can do.</p>
  
  <p>To me, the obvious way to set permissions on interactions on the data (held behind the app server) would be to associate certain permissions with different redux actions. Then, when a user saves their state the client side app would bundle up the users action history and send it back to the server. These actions could then be applied to the data in the server and permissions could be checked, action by action, against a user jwt.</p>
  
  <p>This would mean lots our reducer code could be used isomorphically on the server.</p>
  
  <p>I cannot find any resources/disscussions on this. What is the normal way of handling complex permissions in a redux app? Having auth purely at the endpoint seems cumbersome , this would require rewriting a ton of new code that is already written in client side reducers. Is the any reason not to go ahead and create a reducer which checks auth on each action?</p>
  
  <p>Points:</p>
  
  <ul>
  <li> We must assume actions sent to the server are authenticated, but sent by users that do not have permission dispatch these actions</li>
  <li> If the permissions have been checked and are inside the actions then the reducer can check permissions and be pure</li>
  </ul>