RBAC.js - Role-Based Access Control for Node.js

Table of Contents

1. Introduction
2. Installation
3. Usage
4. Core Concepts
   • Roles
   • Permissions
   • Resources
5. Package Features
   • Role Management
   • Permission Management
   • Middleware for Access Control
6. Examples
   • Basic Example
   • Advanced Example with Role Inheritance
7. Extending RBAC
   • Dynamic Role and Permission Management
   • Database Integration
8. License

Introduction

RBAC.js is a lightweight and flexible Role-Based Access Control (RBAC) system for Node.js. This package helps you manage access control based on user roles and permissions. Instead of assigning permissions directly to users, they are assigned to roles, and users are assigned to roles. This simplifies managing access control in large applications by centralizing the logic around roles.

Key Features:

• Simple to use with an intuitive API.
• Middleware to protect routes.
• Role inheritance (e.g., Admin can inherit Moderator permissions).
• Customizable permission checks.

Installation

To install RBAC.js, use npm:

npm install rbac-js

Usage

1. Defining Roles and Permissions: Define roles and permissions centrally, as shown below:

   const roles = {
     Admin: { permissions: ['read', 'write', 'delete'] },
     User: { permissions: ['read'] },
     Moderator: { permissions: ['read', 'delete'] }
   };

2. Assigning Roles to Users:

   const mockUsers = {
     admin: { roles: ['Admin'] },
     user: { roles: ['User'] },
     moderator: { roles: ['Moderator'] },
     multiRoleUser: { roles: ['User', 'Admin'] }
   };

3. Protecting Routes: Use the rbacMiddleware to protect your routes:

   app.delete('/posts/:id', rbacMiddleware('delete', 'posts'), (req, res) => {
     res.send(`Post with ID ${req.params.id} deleted`);
   });

Core Concepts

• Roles: Represent a user’s responsibilities (e.g., Admin, User).
• Permissions: Define actions a role can perform (e.g., read, write).
• Resources: Objects or data that permissions apply to (e.g., posts, users).

Package Features

• Role Management: Create, update, and delete roles.
• Permission Management: Assign specific permissions to roles based on actions like read, write, delete.
• Middleware for Access Control: Protect routes using RBAC middleware.
• Role Inheritance: Optional feature where roles can inherit permissions from other roles.

Examples

Basic Example

const roles = {
  Admin: { permissions: ['read', 'write', 'delete'] },
  User: { permissions: ['read'] }
};

app.delete('/posts/:id', rbacMiddleware('delete', 'posts'), (req, res) => {
  res.send('Post deleted');
});

Advanced Example with Role Inheritance

const roles = {
  SuperAdmin: { inherits: ['Admin'], permissions: ['manage-all'] },
  Admin: { inherits: ['User'], permissions: ['read', 'write', 'delete'] },
  User: { permissions: ['read'] }
};

app.post('/manage-users', rbacMiddleware('manage-all', 'users'), (req, res) => {
  res.send('User management actions');
});

Extending RBAC

• Dynamic Role and Permission Management: Use a database to manage roles and permissions.
• Database Integration: Store roles, users, and permissions in a database such as MongoDB or PostgreSQL.

License

This project is licensed under the MIT License.