@casl/ability

Isomorphic authorization — define what a user can and cannot do once, then enforce it everywhere.

@casl/ability

General JS

Isomorphic authorization — define what a user can and cannot do once, then enforce it everywhere.

Fit

Install size includes transitive dependencies. Bundle size is gzipped browser payload.

Freshness

The Problem

Permission checks tend to scatter across the codebase as ad-hoc if (user.role === 'admin') conditionals, duplicated between the API and the UI. They drift out of sync, and expressing rules like "editors can update only their own posts" turns into spaghetti.

What It Does

CASL lets you declare abilities in one place — subject, action, and optional conditions — and then check them with can/cannot on both the server and the client. Rules support attribute-based conditions and field-level permissions, and the same ability instance can drive route guards, query filtering, and UI visibility.

Installation

bash
npm install @casl/ability

Usage Example

js
import { AbilityBuilder, createMongoAbility } from '@casl/ability';

function defineAbilitiesFor(user) {
  const { can, cannot, build } = new AbilityBuilder(createMongoAbility);
  can('read', 'Post');
  can('update', 'Post', { authorId: user.id });
  cannot('delete', 'Post');
  return build();
}

const ability = defineAbilitiesFor({ id: 42 });
ability.can('update', { __type: 'Post', authorId: 42 }); // true

Related packages