Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Roles and permissions system for Nodejs

ACL / Roles + Permissions Simple and elegant, create your own checks. No middleware? Use as middleware, create your own roles and access. Great choice. Similar to connect roles... but a bit more robust? you can create roles and action, and associate many roles with that action Like canCan for rails. This is a traditional controller / function type permission system. May be too abstract. More traditional setRole() hasRole() based checking. Last activity 2 years ago. Natural language style roles. Looks very promising and is in active development Simple and closer to action / natural language based. Requires writing your own checks for each. Maybe too simple? Makes sense for assigning roles but then its hard to check against roles! Not ideal but here for reference sake.

Mongoose Field Access Control Set access per field of mongoose Schema. Not supported or maintained, and noted as not a perfect fit in all cases... but worth considering as a simple way to control access to fields.

Copy link

kharhys commented Sep 13, 2015

Hi, Great compilation.
You might want to correct a typo on the gist's name (

Copy link

Thanks for a compiled list of somethings out there.

Copy link

tenodi commented Sep 28, 2015

Copy link

emerak commented Feb 18, 2016

Awesome! 🤘

Copy link

Thanks for the collection!

Copy link

Thanks a lot !!!

Copy link

Thanks man, very usefull... \o

Copy link

chichivica commented Feb 16, 2017

current popularity rank (based on dowloads count)

  1. acl
  2. connect-roles
  3. authorized
  4. virgen-acl
  5. permission
  6. ability
  7. simplepermissions
  8. entitlement

Copy link

Copy link

onury commented May 10, 2017

Here is my approach

var permission = ac.can(role).createOwn(resource);
if (permission.granted) {
    // do stuff...
} else {

Copy link

kabala commented Jul 25, 2017

Thx so much!

Copy link

AGhost-7 commented Dec 27, 2017

Shameless plug! :

Above is an attribute-based access control library. It is designed to be as flexible as possible by using conditions instead of roles. One can implement RBAC or whatever they want using conditions. Module also supports field-level access control that isn't supported by most of the modules listed here.

Copy link

If you wish to enhance the list, we wrote this with my team:

Copy link

mxmzb commented Apr 9, 2018

Here is the real cancan for node.js:

Copy link

Copy link

pak11273 commented Aug 4, 2018

I'm surprised isn't on the list

Copy link

sedzd commented Dec 11, 2018

I'm surprised isn't on the list


Copy link

awesone. thank you guys

Copy link

Nobody talks about

Copy link

ChaitanyaBabar commented May 22, 2020

I'm surprised isn't on the list

Yes , along with casl I think accesscontrol should also be on list.

List of top trends.

Copy link

Does anybody knows a way to have multiorganization roles permissions? I need to create permisssions dynamically depending on customers organizations, which means, I have system permissions, I have each company permissions and the name of the role and it's permissions is not unique, which means a company A could have a Role A and the company B could have Role A, then Role A of company A and Role A of Company B have the same name but different actions associated. So the customers in Company A access their own permissions and Company B access their own permissions.

Copy link

hsluoyz commented Sep 11, 2020

@hackerunet you can try Casbin's RBAC model with domains:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment