stalniy/casl

Health v2 · maintenance only

Adoption not part of the score

7055 stars · 303 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

CASL is an isomorphic JavaScript authorization library that restricts what resources a user is allowed to access, using declarative rules that scale from simple claims to attribute-based access control. It integrates with major frontend frameworks (React, Angular, Vue) and backend ORMs (Mongoose, Prisma), letting permissions be shared across UI, API services, and database queries.

Use cases

• check if a user can perform an action on a resource in a Node.js API
• enforce role-based permissions in a React app UI
• filter database queries by user permissions with Mongoose or Prisma
• share authorization rules between frontend and backend
• implement attribute-based access control in a TypeScript app
• serialize permission rules across microservices

When to choose

• you need fine-grained, declarative authorization in JavaScript/TypeScript
• you want the same permission logic on both client and server
• you need to integrate permissions with ORMs like Mongoose or Prisma
• you want a small, tree-shakable, type-safe access control core

When to avoid

• you need authentication (identity verification) rather than authorization
• you want a fully managed, centralized policy service outside your app code
• your stack is not JavaScript/TypeScript

Facets

library · maturity stable

authorization security middleware security web-development developer-tools browser cross-platform acl permissions rbac abac isomorphic typescript access-control cancan nodejs javascript

Member repositories

For agents

markdown · JSON · MCP: product_card(name="stalniy/casl")