@nwire/rbac

Declarative permissions powered by CASL — defineAbility + middleware + can() resolver.

What it does

Wraps CASL behind a small Nwire surface. defineAbility((user, { allow, deny }) => {...}) declares what each role can do; rbacPlugin auto-enforces tuple action.policy; can("update", "Post") gates resolvers declaratively; ctx.ability() works inside any handler for instance-level checks. Pairs with @nwire/auth so ctx.envelope.user is the input.

Install

pnpm add @nwire/rbac @nwire/auth

Quick start

import { defineAbility, rbacPlugin, can } from "@nwire/rbac";
import { identityPlugin } from "@nwire/auth";
import { defineApp, defineAction } from "@nwire/forge";
import { httpInterface, post } from "@nwire/http";

export const buildAbility = defineAbility((user, { allow, deny }) => {
  if (!user) return;
  if (user.roles?.includes("admin")) {
    allow("manage", "all");
    return;
  }
  allow("read", "Post");
  allow("create", "Post");
  allow("update", "Post", { authorId: user.id });
  allow("delete", "Post", { authorId: user.id });
});

defineApp("my-app", {
  plugins: [identityPlugin({ adapter }), rbacPlugin({ buildAbility })],
});

httpInterface()
  .wire(post("/posts/:id", { policy: ["update", "Post"] }), async ({ input }) => {
    /* ... */
  })
  .run();

API surface

• defineAbility(setup) — declare permissions per user.
• rbacPlugin({ buildAbility }) — plug into createApp.
• can(action, subject) / cannot(action, subject) — handler middleware.
• abilityFromCtx(ctx) / subject(type, obj) — programmatic checks.
• conditionsFor(ability, action, type) — get Mongo-style conditions for query filters.

When to use

Any app that needs per-role authorization beyond action.policy strings. Pair with @nwire/auth so users come from a real IdP.

Within nwire-app

For developers using this package as part of the Nwire stack — register it via app.use(...) or it auto-wires when you compose createApp({ modules }).

import { createApp } from "@nwire/forge";

const app = createApp({
  /* ...config... */
});
// Adapter/plugin wiring happens here when applicable.