# node-rbac

> Hierarchical role based account control implementation for node (with filters)

Latest version **1.1.0** (published 2022-07-12) · BSD license · 0 weekly downloads

## Install

```sh
npm install node-rbac
pnpm add node-rbac
yarn add node-rbac
bun add node-rbac
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.1.0 |
| Published | 2022-07-12 |
| First published | 2014-09-29 |
| Weekly downloads | 0 |
| License | BSD |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 0 |
| Unpacked size | 13.3 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 5 |
| Author | Maksim Chetverikov |
| Maintainers | chetverikov |
| Keywords | abac, rbac, hrbac, access control, authentication, Hierarchical Role Based Access Control, acl |

## Links

- npm: https://www.npmjs.com/package/node-rbac
- Repository: https://github.com/chetverikov/node-rbac
- Homepage: https://github.com/chetverikov/node-rbac#readme
- Issues: https://github.com/chetverikov/node-rbac/issues
- npm.io page: https://npm.io/package/node-rbac

## Alternatives

- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads

## Recent versions

- 1.1.0 (latest) — 2022-07-12
- 1.0.0 — 2019-08-28
- 1.0.0-beta — 2019-05-29
- 0.2.2 — 2015-02-17
- 0.2.1 — 2015-02-02
- 0.2.0 — 2015-01-21
- 0.1.4 — 2014-12-19
- 0.1.3 — 2014-10-24
- 0.1.2 — 2014-10-02
- 0.1.1 — 2014-09-29

## README

# node-rbac

It is implementation of hierarchical role based account control implementation for node (with filters).

## Install

Install it using following command:

```> npm install node-rbac```

## Rule schema

```js
    {
        name: String,        // required. Name of rule
        children: [String],  // optional. List of rules 
        deny: Boolean        // optional. Return false for this rule when it set as true
        filter: () => {}     // optional. Test functions which returns true/false
    }
```

## Settings

```js
    {
        strategy: String  // optional. Strategy can be ALL_ALLOWED, ANY_ALLOWED, ALL_DENIED, ANY_DENIED @see RBAC.STRATEGIES
    }
```

## Usage

```js
const RBAC = require('node-rbac');

// Create a main instance of RBAC with all tree of rules
const rbac = new RBAC([
  {
    name: 'Guest',
    children: [
      'Comments viewer',
      'Posts viewer'
    ]
  },

  {
    name: 'User',
    children: [
      'Users viewer', 'users self manage',
      'Comments viewer', 'comments self manage', 'comments create',
    ]
  },

  {
    name: 'Comment Manager', // can delete any comment, because doesn't have rule with filter
    children: [
      'Users viewer', 'users self manage',
      'comments update', 'comments delete', 'comments create',
    ]
  },

  {
    name: 'Comments viewer',
    children: ['comments one', 'comments list']
  },
  {
    name: 'comments self manage',
    children: ['comments update', 'comments delete'],
    filter: params => String(params.userId) === String(params.commentAuthorId) // returns true if current user is author of comment
  },

  {
    name: 'comments create'
  },
  {
    name: 'comments one'
  },
  {
    name: 'comments list'
  },
  {
    name: 'comments update'
  },
  {
    name: 'comments delete'
  }
], { strategy: RBAC.STRATEGIES.ANY_ALLOWED });

// Create instance of RBAC for selected roles
const userRbac = rbac.getInstance(['User']);
const params = {userId, commentAuthorId};

if (userRbac.can('comments delete', params)) {
    // delete comment
}

```

---
_Source: https://npm.io/package/node-rbac · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._