NestJS OSO – Authorization code for NestJS

oso is an open-source policy engine for authorization that’s embedded in your application. It provides a declarative policy language for expressing authorization logic. You define this logic separately from the rest of your application code, but it executes inside the application and can call directly into it.

nestjs-oso is a library that simplifies the implementation of oso with NestJS.

Features

• @OsoClass decorator (automatically registers the class to use within Oso)
• OsoService (a ready to use NestJS service)

Quickstart

▶ yarn add nestjs-oso oso

import { Module } from '@nestjs/common';
import { OsoModule } from 'nestjs-oso';

@Module({
  imports: [
    OsoModule.forRoot({
      loadFiles: ['./permissions.polar'],
      // or multiple files
      // loadFiles: ['./permissions.polar', './other-policies.polar'],
      // or using wildcards
      // loadFiles: ['./**/*.polar']
    }),
  ],
})
export class AppModule {}

Tip: You don't have to apply either loadFiles or loadStr. You can inject OsoService and access the original API for oso anytime!

Example

You can easily inject OsoService to be used in your services, controllers, etc.

import { Injectable } from '@nestjs/common';
import { OsoService } from 'nestjs-oso';

@Injectable()
export class AuthService {
  constructor(private oso: OsoService) {}
  /*
    Implementation that makes use of this.oso
  */
}

To register an class with oso, use the decorator:

import { OsoClass } from 'nestjs-oso';

@OsoClass()
export class User {
  id: string;
}

This will automatically be registered using registerClass function in oso.

Add Polar files to assets in nest-cli.json

In the nest-cli.json file, we add the assets property to distribute non-Typescript files and watchAssets to turn on watching all non-Typescript assets. In our case, we probably want to add *.polar files to be automatically copied to the dist folder and reloaded when changed.

You can find an example in osohq/oso-nest-doc-mgmt.

{
  "compilerOptions": {
    "assets": ["**/*.polar"],
    "watchAssets": true
  }
}

Contribute & Disclaimer

We love to get help 🙏 Read more about how to get started in CONTRIBUTING 🌳