A powerful and flexible role-based access control (RBAC) library for modern JavaScript and TypeScript applications.
- Policies: Define granular access control rules.
- Guards: Apply global or contextual restrictions.
- Async Guards: Handle asynchronous operations seamlessly.
- Lightweight: Minimal dependencies, fast performance.
- TypeScript Support: Fully typed API for improved developer experience.
For full Documentation.
Install the package via npm or yarn:
npm install access-gate
# or
yarn add access-gate
import { Gate, Policy } from "access-gate";
const gate = new Gate();
// Define a policy
const postPolicy = new Policy("post");
postPolicy.define("update", (user, post) => user.id === post.authorId);
gate.addPolicy(postPolicy);
// Access the policy
const representative = gate.build({ id: 1 });
const decision = representative.access("post", "update").can({ authorId: 1 });
console.log(decision); // true
A Policy represents a set of actions that define access rules.
const postPolicy = new Policy("post");
postPolicy.define("view", (user, post) => true);
postPolicy.define("update", (user, post) => user.id === post.authorId);
gate.addPolicy(postPolicy);
Guards define global or contextual access rules.
gate.guard((user) => user.isAdmin);
Lazy guards are entity-specific restrictions.
gate.lazyGuard((user, post) => user.id === post.authorId);
A Decision object represents the result of evaluating a policy or guard.
const decision = representative.access("post", "view");
console.log(decision.can()); // true
The Gate
class manages policies and guards.
addPolicy(policy: Policy)
: Adds a policy.guard(fn: Guard)
: Adds a global guard.lazyGuard(fn: LazyGuard)
: Adds a lazy guard.
The Policy
class defines a set of rules.
define(action: string, fn: (user, entity) => boolean)
: Defines a policy action.can(action: string)
: Evaluates if an action can be performed.
The Representative
class evaluates access based on policies and guards.
access(policy: string, action: string)
: Accesses a policy decision.can(entity?: object)
: Evaluates synchronous access.could(entity?: object)
: Evaluates async access.
gate.asyncLazyGuard(async (user, resource) => {
const hasAccess = await someAsyncCheck(user, resource);
return hasAccess;
});
// provide
gate.guard((user, provide) => {
const role = getRole(user);
provide("role", role);
});
// inject
policy.define("update", (user, entity) => {
const role = this.inject("role");
return role === "user" && user.id === entity.authorId;
});