Casbin

An authorization library that supports access control models like ACL, RBAC...

Authentication / AuthorizationAPI wrapper / SDK
casbin/node-casbincasbin.orgcasbin

README

Node-Casbin


💖 [Looking for an open-source identity and access management solution like Okta, Auth0, Keycloak ? Learn more about: Casdoor](https://casdoor.org/)

casdoor

News: still worry about how to write the correct node-casbin policy? Casbin online editor is coming to help!

node-casbin is a powerful and efficient open-source access control library for Node.JS projects. It provides support for enforcing authorization based on various access control models.

Documentation


https://casbin.org/docs/overview

Installation


  1. ```shell script
  2. # NPM
  3. npm install casbin --save

  5. # Yarn
  6. yarn add casbin
  7. ```

Get started


New a node-casbin enforcer with a model file and a policy file, see Model section for details:

  1. ```node.js
  2. // For Node.js:
  3. const { newEnforcer } = require('casbin');
  4. // For browser:
  5. // import { newEnforcer } from 'casbin';

  7. const enforcer = await newEnforcer('basic_model.conf', 'basic_policy.csv');
  8. ```

Note: you can also initialize an enforcer with policy in DB instead of file, see Persistence section for details.


Add an enforcement hook into your code right before the access happens:

  1. ```node.js
  2. const sub = 'alice'; // the user that wants to access a resource.
  3. const obj = 'data1'; // the resource that is going to be accessed.
  4. const act = 'read'; // the operation that the user performs on the resource.

  6. // Async:
  7. const res = await enforcer.enforce(sub, obj, act);
  8. // Sync:
  9. // const res = enforcer.enforceSync(sub, obj, act);

  11. if (res) {
  12.   // permit alice to read data1
  13. } else {
  14.   // deny the request, show an error
  15. }
  16. ```

Besides the static policy file, node-casbin also provides API for permission management at run-time.
For example, You can get all the roles assigned to a user as below:

  1. ```node.js
  2. const roles = await enforcer.getRolesForUser('alice');
  3. ```

See Policy management APIs for more usage.

Policy management


Casbin provides two sets of APIs to manage permissions:

- Management API: the primitive API that provides full support for Casbin policy management.
- RBAC API: a more friendly API for RBAC. This API is a subset of Management API. The RBAC users could use this API to simplify the code.

Official Model


https://casbin.org/docs/supported-models

Policy persistence


https://casbin.org/docs/adapters

Policy consistence between multiple nodes


https://casbin.org/docs/watchers

Role manager


https://casbin.org/docs/role-managers

Contributors


This project exists thanks to all the people who contribute.

Backers


Thank you to all our backers! 🙏 [Become a backer]


Sponsors


Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]

License


This project is licensed under the Apache 2.0 license.

Contact


If you have any issues or feature requests, please contact us. PR is welcomed.

- https://github.com/casbin/node-casbin/issues
- hsluoyz@gmail.com
- Tencent QQ group: 546057381