@superawesome/permissions

<!doctype html> <html class="no-js" lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>SuperAwesome Permissions (@superawesome/permissions)</title> <meta name="description" content=""> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" type="image/x-icon" href="../images/favicon.ico"> <link rel="stylesheet" href="../styles/style.css"> <link rel="stylesheet" href="../styles/postmark.css"> </head> <body> <div class="navbar navbar-default navbar-fixed-top visible-xs"> <a href="../" class="navbar-brand">SuperAwesome Permissions (@superawesome/permissions)</a> <button type="button" class="btn btn-default btn-menu ion-ios-menu" id="btn-menu"></button> </div> <div class="xs-menu menu" id="mobile-menu"> <div id="book-search-input" role="search"><input type="text" placeholder="Type to search"></div> <compodoc-menu></compodoc-menu> </div> <div class="container-fluid main"> <div class="row main"> <div class="hidden-xs menu"> <compodoc-menu mode="normal"></compodoc-menu> </div>  <div class="content additional-page"> <div class="content-data"> <h1 id="future-roadmap">Future Roadmap</h1> <p>In the future, SuperAwesome Permissions aims to improve around these objectives:</p> <p><strong>Note</strong>: these Release numbers dont correspond to package module versions that follow <a href="https://semver.org/">semantic versioning</a> (see readme.md).</p> <h2 id="release-1-current">Release #1 (current)</h2> <h4 id="native-support">Native support</h4> <p>We will welcome & aid the community to develop native Plugins / Middleware / Decorators / Guards etc for <strong>expressjs, koa, GraphQL / Apollo, Loopback, Angular, React, Vue</strong> & more...</p> <h4 id="core-features">Core features</h4> <ul> <li><p>Fix serious bugs & shortcomings reported by users </p> </li> <li><p>Fix of Caveats #1 "Leaky Actions" & #2 "Merged own Attributes of multiple roles"</p> </li> <li><p>Validations for PermissionsDefinitions, PermitGrantQuery etc using class-validator.</p> </li> <li><p>Improved & more tests </p> </li> <li><p>Freeze features unless really needed.</p> </li> </ul> <h4 id="extras--docs">Extras & docs</h4> <ul> <li><p>Improve typings </p> </li> <li><p>Better documents & generated doc tests</p> </li> <li><p>Add missing docs & some helpers around PermissionDefinition consolidations ( i.e see <code>consolidations.ts</code> & <code>getDefinitions()</code>).</p> </li> </ul> <h2 id="release-2">Release #2</h2> <ul> <li><p>Split the <code>addDefinitions()</code> and <code>.grantPermit()</code> parts to 2 different classes / instances (currently both live in <code>Permissions</code>).</p> </li> <li><p>Improve integration tests around features rather than "role X can do this" etc.</p> </li> <li><p>Fix any bugs & shortcomings from R1.</p> </li> <li><p>Deprecating <code>listOwn()</code> would be too drastic. And it might have some good use cases also. So we'll make it optional, while <code>limitOwn</code> will be the mandatory. We can even auto-generate <code>listOwn</code> & <code>isOwner</code>/<code>isOwn</code>, if user gives us a way query over the resource item IDs (i.e query the DB) using given <code>limitOwn()</code>.</p> </li> </ul> <h2 id="release-3">Release #3</h2> <ul> <li><p>Investigate <strong>Custom Possessions</strong>:</p> <ul> <li><p>Possessions are defined by developers (and even end users with some help from devs) and can be completely programmable & arbitrary. They can be domain specific but also generalized within your service. They can be anything from <code>"own", "purchased", "created", "company", "department", "guild", "team", "project", "country", "confidential"</code> up to <code>"userHasParticipatedInOurLastChristmasBallAfterParty"</code> so they can see the exclusive photos ;-) You get the idea!</p> </li> <li><p>Imaginary definition and usage looks trivial & very close to SuperAwesome Permissions R1 philosophy. Imagine:</p> </li> </ul> <div><pre class="line-numbers"><code class="language-js">// PermissionDefinition R3 - imaginary :-) const permissionDefinition = { ..., possessions: { own: ({ user, resourceId }) => hasUserPurchasedResource({ user, resourceId }), project: ({ user, resourceId }) => isUserInSameProjectAsTheDocument({ user, documentId: resourceId }), company: ({ user, resourceId }) => isUserInSameCompanyAsTheDocument({ user, documentId: resourceId }), }, grant: { 'list:own': ['*'], 'list:project': ['*', '!confidential'], 'list:company': ['title', 'date'], }, }; await permit.is('own')(documentId); // true / false depending on above await permit.is('company')(documentId); // true / false depending on above docs.filter(permit.limit('own')); // filters documents according to "own" possession only docs.filter(permit.limit('company')); // filters documents according to "own" possession only docs.filter(permit.limit()); // filters documents all possessions effective for user. await permit.mapPick(docs.filter(permit.limit())); // a list of all documents allowed by each possession, but only with the allowed attributes depending on the positively evaluated possession rules.</code></pre></div></li> <li><p>Investigate "extend" of Roles - currently disabled. Implement if successful.</p> </li> <li><p>Investigate whether "deny" (i.e the opposite of <code>grant: TGrants</code>) has any valid use cases, especially if extend is implemented.</p> </li> </ul> </div><div class="search-results"> <div class="has-results"> <h1 class="search-results-title"><span class='search-results-count'></span> result-matching "<span class='search-query'></span>"</h1> <ul class="search-results-list"></ul> </div> <div class="no-results"> <h1 class="search-results-title">No results matching "<span class='search-query'></span>"</h1> </div> </div> </div>  </div> </div> <script> var COMPODOC_CURRENT_PAGE_DEPTH = 1; var COMPODOC_CURRENT_PAGE_CONTEXT = 'additional-page'; var COMPODOC_CURRENT_PAGE_URL = 'future-roadmap.html'; </script> <script src="../js/libs/custom-elements.min.js"></script> <script src="../js/libs/lit-html.js"></script>  <script src="../js/libs/custom-elements-es5-adapter.js" charset="utf-8" defer></script> <script src="../js/menu-wc.js" defer></script> <script src="../js/libs/bootstrap-native.js"></script> <script src="../js/libs/es6-shim.min.js"></script> <script src="../js/libs/EventDispatcher.js"></script> <script src="../js/libs/promise.min.js"></script> <script src="../js/libs/zepto.min.js"></script> <script src="../js/compodoc.js"></script> <script src="../js/tabs.js"></script> <script src="../js/menu.js"></script> <script src="../js/libs/clipboard.min.js"></script> <script src="../js/libs/prism.js"></script> <script src="../js/sourceCode.js"></script> <script src="../js/search/search.js"></script> <script src="../js/search/lunr.min.js"></script> <script src="../js/search/search-lunr.js"></script> <script src="../js/search/search_index.js"></script> <script src="../js/lazy-load-graphs.js"></script> </body> </html>