Stone.js · Authorization

Framework-agnostic, isomorphic authorization for Stone.js built on CASL. RBAC + ABAC with the same rules on the backend and the frontend — define abilities once, guard routes and shape the UI.

Part of Stone.js, the reference implementation of the Continuum Architecture: write your domain once, and the context (runtime, protocol, caller) applies to it at run time.

Install

npm i @stone-js/authz

Enabling it

Like every Stone.js module, it is enabled in one of two ways, and configured afterwards under stone.authz. It registers the authorization provider and the kernel middleware that builds the caller's abilities.

import { Authz } from '@stone-js/authz'
import { StoneApp } from '@stone-js/core'

@Authz()
@StoneApp({ name: 'my-app' })
export class Application {}

import { defineStoneApp } from '@stone-js/core'
import { authzBlueprint } from '@stone-js/authz'

export const Application = defineStoneApp({ name: 'my-app' }, [authzBlueprint])

Configure it from a @Configuration class or defineConfig:

export const AppConfig = defineConfig((blueprint) => blueprint.set('stone.authz', { /* ... */ }))

Usage

import { authorize } from '@stone-js/authz'
import { EventHandler, Patch } from '@stone-js/router'

@EventHandler('/posts')
export class PostController {
  // CASL-backed guard: 403 unless the principal may 'update' this 'Post'.
  @Patch('/:id', { middleware: [authorize('update', 'Post')] })
  update (event) { /* ... */ }
}

// The same ability rules run on the backend and in the frontend (isomorphic).

Documentation

Full documentation: stonejs.dev/docs/extensions/authorization.

License

MIT © Evens Pierre ("Mr. Stone") and the Stone.js contributors.