# access-control-rules

> Access control for hierarchical data

Latest version **2.0.0** (published 2015-06-26) · WTFPL license · 0 weekly downloads

## Install

```sh
npm install access-control-rules
pnpm add access-control-rules
yarn add access-control-rules
bun add access-control-rules
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 2.0.0 |
| Published | 2015-06-26 |
| First published | 2015-06-26 |
| Weekly downloads | 0 |
| License | WTFPL |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 0 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Author | jesse.tane@gmail.com |
| Maintainers | jessetane |
| Keywords | access, control, rules, hierarchical, data |

## Links

- npm: https://www.npmjs.com/package/access-control-rules
- Repository: https://github.com/jessetane/access-control
- Homepage: https://github.com/jessetane/access-control#readme
- Issues: https://github.com/jessetane/access-control/issues
- npm.io page: https://npm.io/package/access-control-rules

## Alternatives

- [gamedig](https://npm.io/package/gamedig.md) — 29.3K weekly downloads
- [join-monster](https://npm.io/package/join-monster.md) — 12.8K weekly downloads
- [masked](https://npm.io/package/masked.md) — 5.5K weekly downloads
- [@comunica/actor-query-process-explain-logical](https://npm.io/package/@comunica/actor-query-process-explain-logical.md) — 4.7K weekly downloads
- [@veracity/vui](https://npm.io/package/@veracity/vui.md) — 4.6K weekly downloads

## Recent versions

- 2.0.0 (latest) — 2015-06-26

## README

# access-control-rules
Access control for hierarchical data.

## Why
Factored out of a [hyperbase](https://github.com/jessetane/hyperbase) server implementation.

## How
Make some rules:

``` javascript
var rules = {
  '.read': true,
  things: {
    '$id': {
      '.read': function (cb) {
        cb(null, this.id === '0')
      },
      '.write': function (value, cb) {
        cb(null, value && this.id === '0')
      },
      nested: {
        reserved: {
          '.write': false
        }
      }
    }
  }
}
```

Then check to see if you have permission to read and write stuff:
``` javascript
var ac = require('access-control-rules')

ac.read(rules, null, '/things/0'.split('/'), function (err, allow) {
  // allow === true
})

ac.read(rules, null, '/things/1'.split('/'), function (err, allow) {
  // allow === false
})

ac.write(rules, null, '/things/0'.split('/'), 'thing!', , function (err, allow) {
  // allow === true
})

ac.write(rules, null, '/things/1'.split('/'), 'thing!', function (err, allow) {
  // allow === false
})

ac.write(rules, null, '/things/0'.split('/'))
  // allow === false
})

ac.write(rules, null, '/things/0'.split('/'), { nested: { x: 42 }}, function (err, allow) {
  // allow === true
})

ac.write(rules, null, '/things/0'.split('/'), { nested: { reserved: 42 }}, function (err, allow) {
  // allow === false
})
```

## Test
`$ npm test`  
`$ npm run test-browser` (depends on a globally installed [zuul](https://github.com/defunctzombie/zuul))

## Prior art
The idea is based on [Firebase's security rules](https://www.firebase.com/docs/security/guide/). The main important difference is that ".read" rules do not check any nested rules - this allows masking specific fields when reading objects.

## License
WTFPL

---
_Source: https://npm.io/package/access-control-rules · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._