casbin

A powerful authorization library that supports RBAC, ABAC, ACL and more via configurable policy models.

casbin

Node.js

A powerful authorization library that supports RBAC, ABAC, ACL and more via configurable policy models.

npmGitHubDocs

Fit

Bundle (gzip)

40.6 kB

152.1 kB raw

Install size includes transitive dependencies. Bundle size is gzipped browser payload.

Freshness

The Problem

Hard-coding an authorization scheme is fine until requirements change — you start with simple roles, then need per-resource rules, then multi-tenant domains. Rewriting enforcement logic each time is risky, and mixing policy with application code makes audits painful.

What It Does

Casbin separates the authorization model (defined in a PERM config file) from the policy (the actual rules, stored in a file, database, or adapter). By swapping the model you can implement ACL, RBAC with role hierarchies, ABAC, or multi-tenant patterns without touching your enforcement calls. It has adapters for virtually every datastore.

Installation

bash
npm install casbin

Usage Example

js
const { newEnforcer } = require('casbin');

const enforcer = await newEnforcer('model.conf', 'policy.csv');

if (await enforcer.enforce('alice', 'data1', 'read')) {
  // alice is allowed to read data1
} else {
  // request denied
}

Related packages

accesscontrolNode.js

Role and attribute based access control (RBAC + ABAC) for Node.js with a fluent, readable API.

bcryptjsNode.js

Pure JavaScript bcrypt password hashing — no native dependencies, same API as bcrypt, works anywhere Node.js runs.

bullmqNode.js

Premium message queue and job scheduler for Node.js backed by Redis — reliable background job processing with retries, priorities, and rate limiting.

dotenvNode.js

Load environment variables from a `.env` file into `process.env` — the standard way to manage configuration in Node.js apps.

execaNode.js

Process execution for Node.js — a better child_process with Promises, streaming, and a clean cross-platform API.