# flexappeal-acl

> Simple ACL implementation that we use at Flex-Appeal.

Latest version **0.0.3** (published 2016-06-24) · MIT license · 0 weekly downloads

## Install

```sh
npm install flexappeal-acl
pnpm add flexappeal-acl
yarn add flexappeal-acl
bun add flexappeal-acl
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.0.3 |
| Published | 2016-06-24 |
| First published | 2016-06-23 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 0 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Author | Flex-Appeal Developers |
| Maintainers | guidsen |
| Keywords | acl, authorization, permissions |

## Links

- npm: https://www.npmjs.com/package/flexappeal-acl
- Repository: https://github.com/FlexAppeal/authorization
- Homepage: https://github.com/FlexAppeal/authorization#readme
- Issues: https://github.com/FlexAppeal/authorization/issues
- npm.io page: https://npm.io/package/flexappeal-acl

## Alternatives

- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads

## Recent versions

- 0.0.3 (latest) — 2016-06-24
- 0.0.2 — 2016-06-24
- 0.0.1 — 2016-06-23

## README

## Registering the plugin:

Options arguments
```
actions: Object
role: Function|String -> String
```

```
import actions from './actions';

const roleFn = (req) => {
  return db.getRole(req.auth.credentials) === 'admin') {
    return roles.admin;
  }
  
  return roles.employee;
}

server.register({
  register: require('flex-acl'),
  options: { actions, role: roleFn },
});
```

## Defining the actions:

Action can contain the following properties:
```
type ActionType {
  role: String,
  validate: Function -> Boolean
}

action: Array<String>|ActionType
```

Example:
```
const actions = {
  'create-exchange': ['employee', 'admin']
  'delete-exchange': {
    role: 'admin',
    validate: (user, exchange) => {
      return exchange.userId === user.id;
    },
  },
};
```

<!--Routes:-->
<!--```-->
<!--server.route({ method: 'POST', path: '/exchanges/{exchangeId}', config: {-->
<!--  plugins: { 'hapi-acl': { action: 'create-exchange'} },-->
<!--  handler: function (request, reply) { reply("Deleted user as admin.");}-->
<!--}});-->
<!--```-->

<!--Advanced validate routing:-->
<!--```-->
<!--server.route({ method: 'DELETE', path: '/exchanges/{exchangeId}', config: {-->
<!--  plugins: { 'hapi-acl': { action: 'delete-exchange' } },-->
<!--  handler: function (request, reply) { reply("Deleted user as admin.");}-->
<!--}});-->
<!--```-->

## Helpers:

You can use the `can` helper to validate if the user is allowed to execute the action. It will return a boolean.  
`can(user, action: String, itemToValidate: Object) -> Boolean`

```
const handler = (req, reply) => {
  const exchange = db.getExchange(req.params.id);

  if (!can(req.auth.credentials, 'delete-exchange', exchange)) {
    return reply('User cannot delete exchange.');
  }
  
  return reply('Exchange deleted.');
}
```

This is the same as the `can` helper, but will throw an error when the result will be false.  
`check(user, action: String, itemToValidate: Object) -> Error|void`

```
const handler = (req, reply) => {
  const exchange = db.getExchange(req.params.id);
  
  try {
    check(req.auth.credentials, 'delete-exchange', exchange);
  
    return reply('Exchange deleted.');
  } catch (err) {
    return reply('User cannot delete exchange.');
  }
}
```

---
_Source: https://npm.io/package/flexappeal-acl · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._