express-acler/index.js

ACL manager for Express using ACLer

const { check } = require("acler");
const dp = require("dot-prop-immutable");

const R = require("ramda");

module.exports = config => {
  const defaults = {
    roles: "user.roles",
    permissions: "user.permissions",
    errors: {
      roles: "You not allowed to this resource",
      permissions: "You not allowed to this resource"
    }
  };

  const { roles, permissions, errors } = R.merge(defaults, config);
  return {
    is(acl) {
      return (req, res, next) => {
        const r = dp.get(req, roles);
        if (!r) {
          throw Error("User roles is required");
        }

        const is = check(acl, roles => {
          return r.includes(roles);
        });

        if (!is) {
          throw Error(errors.roles);
        }

        next();
      };
    },
    can(acl) {
      return (req, res, next) => {
        let p = dp.get(req, permissions);
        const r = dp.get(req, roles);

        if (!p) {
          throw Error("User permissions is required");
        }

        if (r) {
          r.forEach(role => {
            rolesPermissions = [];
            if (typeof role === "object") {
              rolesPermissions = R.concat(
                rolesPermissions,
                R.head(R.values(role))
              );
            }
          });

          p = R.uniq(p.concat(rolesPermissions));
        }

        const is = check(acl, permissions => {
          return p.includes(permissions);
        });

        if (!is) {
          throw Error(errors.permissions);
        }

        next();
      };
    }
  };
};