2e66ca9 feat: upgrade minimatch dependency to 10.2.1 (#545) by Yang Luo · 3 weeks ago master v5.49.0
d086457 feat: implement self* methods using WithoutNotify pattern (sync with Go) (#539) by Huggin · 9 weeks ago v5.48.0
4d68d28 feat: prevent wildcard deletion in deleteUser/deleteRole APIs (#519) by Yang Luo · 9 weeks ago v5.47.0
d8a7cba feat: add 4 new Ex APIs: addPoliciesEx, addGroupingPoliciesEx, addNamedPoliciesEx, addNamedGroupingPoliciesEx (#535) by Yang Luo · 10 weeks ago v5.46.0
c4b289f fix: improve links in README by Yang Luo · 2 months ago v5.45.3

Node-Casbin

News: still worry about how to write the correct node-casbin policy? Casbin online editor is coming to help!

casbin Logo

node-casbin is a powerful and efficient open-source access control library for Node.JS projects. It provides support for enforcing authorization based on various access control models.

All the languages supported by Casbin:


Casbin	jCasbin	node-Casbin	PHP-Casbin
production-ready	production-ready	production-ready	production-ready


PyCasbin	Casbin.NET	Casbin-CPP	Casbin-RS
production-ready	production-ready	beta-test	production-ready

Documentation

https://casbin.org/docs/overview

Installation

# NPM
npm install casbin --save

# Yarn
yarn add casbin

Get started

New a node-casbin enforcer with a model file and a policy file, see Model section for details:

// For Node.js:
const { newEnforcer } = require('casbin');
// For browser:
// import { newEnforcer } from 'casbin';

const enforcer = await newEnforcer('basic_model.conf', 'basic_policy.csv');

Note: you can also initialize an enforcer with policy in DB instead of file, see Persistence section for details.

Add an enforcement hook into your code right before the access happens:

const sub = 'alice'; // the user that wants to access a resource.
const obj = 'data1'; // the resource that is going to be accessed.
const act = 'read'; // the operation that the user performs on the resource.

// Async:
const res = await enforcer.enforce(sub, obj, act);
// Sync:
// const res = enforcer.enforceSync(sub, obj, act);

if (res) {
  // permit alice to read data1
} else {
  // deny the request, show an error
}

Besides the static policy file, node-casbin also provides API for permission management at run-time. For example, You can get all the roles assigned to a user as below:

const roles = await enforcer.getRolesForUser('alice');

See Policy management APIs for more usage.

Policy management

Casbin provides two sets of APIs to manage permissions:

Management API: the primitive API that provides full support for Casbin policy management.
RBAC API: a more friendly API for RBAC. This API is a subset of Management API. The RBAC users could use this API to simplify the code.