mongoose-acl
Usage
var mongoose = ;var acl = ; var WidgetSchema = ... ;WidgetSchema; var UserSchema = ... ;UserSchema;
Methods
The plugin adds accessor methods to the object for getting and setting permissions of a particular key:
var widget = ... ; widget;widget; // => ['a', 'b']
Or getting all keys with given permissions:
widget; // => ['foo']
There are also convenience methods added to the subject for getting and setting the permissions for a given object:
var user = ...; user;user; // => ['read', 'write', 'delete']
We can query for all objects to which a particular subject has access:
Widget;
Options
Object
We can specify the path in which the ACL will be stored (by default it will be available at _acl
):
WidgetSchema;
Subject
Each subject is referred to in an ACL by a unique key (by default it is of the form subject:<subject _id>
). This can be customized by specifying a key
option:
UserSchema;
We can also specify additional ACL keys to which a subject has access. For example, suppose a user optionally belongs to a number of roles:
UserSchema;
There is one special key referred to as the public key. If set, the associated permissions will apply to all subjects:
UserSchema;
Hybrid
Combines subject
and object
so that a subject can determine if it has permissions on itself or another "subject". getAccess
and setAccess
methods on the subject are renamed as getSubjectAccess
and setSubjectAccess
, respectively. All other options/methods remain the same. Explicitly:
subject.getAccess --> hybrid.getSubjectAccess
subject.setAccess --> hybrid.setSubjectAccess
UserSchema; var user = ...; user;user;
Install
npm install mongoose-acl
Tests
npm test