feathers-acl

Declarative ACL for Feathers and Express apps.

Configuration

const feathers = require('feathers');
const rest = require('feathers-rest');
const acl = require('feathers-acl');
const services = require('./services');
const customFields = require('./validation-fields');
const db = require('./db');
const aclConfig = JSON.parse(process.env.ACL);

const app = feathers();
app.configure(rest())
  .configure(services)
  .configure(acl(aclConfig, {
    denyNotAllowed: true,             // deny all routes without "allow" rules
    adminRoles: ['admin'],            // allow all listed in config routes for this role
    baseUrl: 'http://localhost:8080', // need for owner rule
    jwt: {
      secret: 'blab',
      header: 'x-auth'                // Default is 'Authorization'
      options: {}                     // options for 'jsonwebtoken' lib
    }
  }));

module.exports = app;

Config example

[
  {
    url: '/posts', method: 'GET',
    allow: { authenticated: false }
  }, {
    url: '/posts', method: 'POST',
    allow: { authenticated: true, roles: ['client', 'admin'] }
  }, {
    url: '/posts/:id', method: 'PATCH',
    allow: {
      authenticated: true, roles: ['admin'],
      owner: { where: { _id: '{params.id}', model: 'posts', ownerField: 'author' } }
    }
  }, {
    url: '/posts', method: 'DELETE',
    allow: { roles: [] } // deny access
  }
]

Rules

Rules should be declared in allow object.

Roles

Set what roles are allowed.

allow: { roles: ['client', 'admin'] }

It gets user's role from req.payload.roles array.

Owner

Give access only for owner. Makes request to GET route and checks ownerField. First of all set:

app.configure(acl(config, { mongooseConnection: db }));

Then in config declare:

allow: {
  owner: { ownerField: 'author' }
}

ownerField - where do you store user id? It gets user's id from req.payload.userId.

Authenticated

You can manage authentication on your own, or set JWT options:

app.configure(acl(config, { jwt: { secret: 'blab', options } }));

And use it in ACL config:

allow: { authenticated: true }