RBAC/Permissions Builder

Implement flexible role-based access control systems.

Permission Matrix

// Define permissions export enum Permission { USER_READ = "user:read", USER_WRITE = "user:write", USER_DELETE = "user:delete", POST_READ = "post:read", POST_WRITE = "post:write", ADMIN_ACCESS = "admin:access", }

// Define roles export const ROLE_PERMISSIONS = { user: [Permission.USER_READ, Permission.POST_READ, Permission.POST_WRITE], moderator: [...userPermissions, Permission.POST_DELETE], admin: Object.values(Permission), // All permissions };

// Check permission export const hasPermission = (user: User, permission: Permission): boolean => { return ROLE_PERMISSIONS[user.role]?.includes(permission) ?? false; };

Route Guards (Express)

export const requirePermission = (...permissions: Permission[]) => { return (req: Request, res: Response, next: NextFunction) => { if (!req.user) { return res.status(401).json({ error: "Unauthorized" }); }

const hasAllPermissions = permissions.every((p) =>
  hasPermission(req.user, p)
);

if (!hasAllPermissions) {
  return res.status(403).json({ error: "Forbidden" });
}

next();

}; };

// Usage router.delete( "/users/:id", authenticate, requirePermission(Permission.USER_DELETE), controller.delete );

Policy Pattern

// policies/user.policy.ts export class UserPolicy { static canUpdate(currentUser: User, targetUser: User): boolean { // Users can update themselves if (currentUser.id === targetUser.id) return true;

// Admins can update anyone
if (hasPermission(currentUser, Permission.USER_WRITE)) return true;

return false;

}

static canDelete(currentUser: User, targetUser: User): boolean { // Can't delete yourself if (currentUser.id === targetUser.id) return false;

// Only admins can delete
return hasPermission(currentUser, Permission.USER_DELETE);

} }

// Usage in controller if (!UserPolicy.canUpdate(req.user, targetUser)) { return res.status(403).json({ error: "Cannot update this user" }); }

Resource Ownership

export const requireOwnership = ( getResourceUserId: (req: Request) => Promise<string> ) => { return async (req: Request, res: Response, next: NextFunction) => { const resourceUserId = await getResourceUserId(req);

// Owner can access
if (req.user.id === resourceUserId) {
  return next();
}

// Admin can access anything
if (hasPermission(req.user, Permission.ADMIN_ACCESS)) {
  return next();
}

return res.status(403).json({ error: "Forbidden" });

}; };

UI Permission Hints

// Return permissions with user GET /api/me { "user": { ... }, "permissions": ["user:read", "post:write"] }

// Frontend helper export const usePermission = (permission: Permission): boolean => { const { user } = useAuth(); return user?.permissions?.includes(permission) ?? false; };

// Usage {usePermission('user:delete') && <DeleteButton />}

Best Practices

• Define permissions granularly (resource:action)

• Check at multiple layers (route, controller, UI)

• Use policies for complex rules

• Cache permission checks

• Log permission denials

• Test all permission paths

Output Checklist

• Permission enum/constants

• Role-to-permission mapping

• Route guard middleware

• Policy classes for complex rules

• Ownership checking utilities

• Permission checking helpers

• UI permission hints endpoint

• Test cases for all permission paths