onury/accesscontrol

Health v2 · maintenance only

Adoption not part of the score

2327 stars · 181 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Node.js library implementing Role-Based Access Control (RBAC) merged with Attribute-Based Access Control (ABAC), including role inheritance, deny-overrides, conditions, and enforced ownership. It offers a chainable API for defining grants and checking permissions on resources and actions.

Use cases

• implement role-based permissions in a Node.js API
• add attribute-based access control policies to an Express app
• define role hierarchies with deny-overrides for user permissions
• enforce ownership rules so users can only modify their own resources
• check CRUD permissions like can(role).createOwn(resource)
• write declarative ABAC conditions with a readable expression syntax

When to choose

• you need combined RBAC and ABAC authorization in a Node.js/TypeScript project
• you want role inheritance with deny-always-wins semantics
• you need ownership enforcement and policy conditions in a lightweight library

When to avoid

• you need a centralized policy server or externalized authorization service
• your stack is not Node.js
• you need fine-grained policy evaluation across distributed microservices with external decision engines

Facets

library · maturity active

authorization security middleware security backend web-development developer-tools rbac abac access-control permissions roles policy-engine esm nodejs typescript

Member repositories

For agents

markdown · JSON · MCP: product_card(name="onury/accesscontrol")