title: Is it legitimate to use the Postgres role system for web app authentication and role management?
body: <h1>MY SITUATION</h1>
  
  <p>I want to create my first end-to-end web application using <strong>React</strong> and <strong>Postgres</strong>. I did use Postgres in a previous job within an intranet and used the Postgres role system for user authentication.</p>
  
  <h1>THE ROLES</h1>
  
  <p>My planned web app would be a <strong>team planning system</strong>. It would consist of the following user roles:</p>
  
  <ul>
  <li><strong>web admin</strong> (me, the superuser)</li>
  <li><strong>team admin</strong> (can INSERT / DROP users within his/her team, set globally
  applied feature settings for the team, etc.)</li>
  <li><strong>team user</strong> (can adjust custom personal settings stored in the<br>
  database, e.g. colors, own profile)</li>
  <li><strong>visitor</strong> (can only view a team and its members)</li>
  </ul>
  
  <h1>MY APPROACH</h1>
  
  <p>My current plan for authentication &amp; role management of users would be to have the above-mentioned roles as Postgres group roles and within each group role, the login role for the corresponding user is located. So the user authentication would be purely managed by Postgres' inbuild role system.</p>
  
  <p>Different data accesses are then applied through </p>
  
  <ul>
  <li>table-based and column-based privilege <a href="https://www.postgresql.org/docs/8.4/sql-grant.html" rel="nofollow noreferrer">GRANT</a>s plus the implementation of views for each group role and</li>
  <li><a href="https://www.postgresql.org/docs/current/ddl-rowsecurity.html" rel="nofollow noreferrer">row security policies</a> for subsetting data to the corresponding team
  of a user.</li>
  </ul>
  
  <p>Is this a good approach?</p>