# koa-accesscontrol

> Accesss control middleware for koa

Latest version **1.0.0** (published 2018-08-10) · MIT license · 0 weekly downloads

## Install

```sh
npm install koa-accesscontrol
pnpm add koa-accesscontrol
yarn add koa-accesscontrol
bun add koa-accesscontrol
```

## Health

**Score 25/100 (F)** — status: abandoned.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.0.0 |
| Published | 2018-08-10 |
| First published | 2018-08-10 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | >=8.0.0 |
| Dependencies | 2 |
| Unpacked size | 22.1 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 2 |
| Author | cernicc |
| Maintainers | cernic |
| Keywords | accesscontrol, koa |

## Links

- npm: https://www.npmjs.com/package/koa-accesscontrol
- Repository: https://github.com/cernicc/koa-accesscontrol
- Homepage: https://github.com/cernicc/koa-accesscontrol#readme
- Issues: https://github.com/cernicc/koa-accesscontrol/issues
- npm.io page: https://npm.io/package/koa-accesscontrol

## Dependencies (2)

- [koa](https://npm.io/package/koa.md) ^2.5.2
- [accesscontrol](https://npm.io/package/accesscontrol.md) ^2.2.1

## Recent versions

- 1.0.0 (latest) — 2018-08-10

## README

# koa-accesscontrol
> This is koa middleware for [accesscontrol](https://onury.io/accesscontrol/)

Middleware filters request body and also response body.

## Installation
```
npm i koa-accesscontrol
```

## Grants
Grants can be loaded from the database or file.
```js
export default {
  admin: {
    users: {
      'create:any': ['*'],
      'read:any': ['*'],
      'update:any': ['*'],
      'delete:any': ['*'],
    },
  },
  user: {
    users: {
      'create:any': ['uuid'],
      'read:own': ['uuid', 'firstname', 'lastname'],
      'update:own': ['firstname', 'lastname', 'email', 'phone'],
      'delete:own': ['uuid'],
    },
  },
};

```

## Usage Example
Use grants object when initializing the Middleware. Also specify the location of user role.
If no operands are specified when using the middleware, checking the ownership of the resource will be skipped.

### TypeScript

```typescript
import * as Koa from 'koa';
import * as Router from 'koa-router';
import { Authorization } from 'koa-accesscontrol';

const grants = {
  user: {
    users: {
      'create:any': ['uuid'],
      'read:own': ['uuid', 'firstname', 'lastname'],
      'update:own': ['firstname', 'lastname', 'email', 'phone'],
      'delete:own': ['uuid'],
    },
  },
};

const app = new Koa();
const router = new Router();
const auth = Authorization(grants, `request.headers.x-something-role`);

router.get('/users',
  auth({
    resource: 'users',
  }), (ctx, next) => {
    ctx.body = 'All users';
  });

router.get('/users/:uuid',
  auth({
    resource: 'users',
    operands: [`request.headers.x-something-uuid`, `params.uuid`],
  }), (ctx, next) => {
    ctx.body = 'One user';
  });

app
  .use(router.routes())
  .use(router.allowedMethods());

app.listen(8080);
```

### JavaScript

```javascript
const Koa = require('koa');
const Router = require('koa-router');
const { Authorization } = require('koa-accesscontrol');

const grants = {
  user: {
    users: {
      'create:any': ['uuid'],
      'read:own': ['uuid', 'firstname', 'lastname'],
      'update:own': ['firstname', 'lastname', 'email', 'phone'],
      'delete:own': ['uuid'],
    },
  },
};

const app = new Koa();
const router = new Router();
const auth = Authorization(grants, `request.headers.x-something-role`);

router.get('/users',
  auth({
    resource: "users",
  }), (ctx, next) => {
    ctx.body = "All users";
  });

router.get('/users/:uuid',
  auth({
    resource: "users",
    operands: [`request.headers.x-something-uuid`, `params.uuid`],
  }), (ctx, next) => {
    ctx.body = "One user";
  });

app
  .use(router.routes())
  .use(router.allowedMethods());

app.listen(8080);
```

## Todo
* Enable option to overwrite actions used for methods

---
_Source: https://npm.io/package/koa-accesscontrol · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._