accesscontrol

Role and attribute based access control (RBAC + ABAC) for Node.js with a fluent, readable API.

accesscontrol

Node.js

Role and attribute based access control (RBAC + ABAC) for Node.js with a fluent, readable API.

npmGitHubDocs

Fit

Bundle (gzip)

16.5 kB

56.0 kB raw

Install size includes transitive dependencies. Bundle size is gzipped browser payload.

Freshness

The Problem

Once an app grows past "admin vs user," permission logic sprawls: who can create versus update, own resources versus any resource, which fields they may even see. Encoding role hierarchies and field-level rules by hand becomes a maintenance hazard.

What It Does

AccessControl models permissions as roles granting actions (create/read/update/delete) over resources, distinguishing "own" from "any" and supporting attribute (field) filtering. Roles can extend other roles, and a grant check returns the permitted attributes so you can filter response payloads automatically.

Installation

bash
npm install accesscontrol

Usage Example

js
const { AccessControl } = require('accesscontrol');

const ac = new AccessControl();
ac.grant('user')
  .readOwn('profile')
  .updateOwn('profile', ['*', '!password']);
ac.grant('admin')
  .extend('user')
  .updateAny('profile');

const permission = ac.can('user').updateOwn('profile');
console.log(permission.granted, permission.attributes);

Related packages

bcryptjsNode.js

Pure JavaScript bcrypt password hashing — no native dependencies, same API as bcrypt, works anywhere Node.js runs.

bullmqNode.js

Premium message queue and job scheduler for Node.js backed by Redis — reliable background job processing with retries, priorities, and rate limiting.

casbinNode.js

A powerful authorization library that supports RBAC, ABAC, ACL and more via configurable policy models.

dotenvNode.js

Load environment variables from a `.env` file into `process.env` — the standard way to manage configuration in Node.js apps.

execaNode.js

Process execution for Node.js — a better child_process with Promises, streaming, and a clean cross-platform API.