description: Minimal authorization engine with deterministic precedence, wildcard support, and runtime predicates. package: permit category: auth keywords: [rbac, permissions, roles, access-control, authorization, wildcards, predicates] related: [logit, routeit, wireit] exports: [createPermit, owns]

@vielzeug/permit

Minimal authorization engine with deterministic precedence, wildcard support, and runtime predicates.

Package: @vielzeug/permit  ·  Category: Auth

Key exports: createPermit, owns

When to use: Minimal authorization engine with deterministic precedence, wildcard support, and runtime predicates.

Related: @vielzeug/logit · @vielzeug/routeit · @vielzeug/wireit

@vielzeug/permit is part of Vielzeug and ships as a zero-dependency TypeScript package with ESM+CJS output.

Installation

pnpm add @vielzeug/permit
npm install @vielzeug/permit
yarn add @vielzeug/permit

Quick Start

import { ANONYMOUS, WILDCARD, createPermit, owns } from '@vielzeug/permit';

const permit = createPermit<'read' | 'update', { authorId: string }>([
  { role: 'editor', resource: 'posts', action: 'read', effect: 'allow' },
  {
    role: 'editor',
    resource: 'posts',
    action: 'update',
    effect: 'allow',
    when: owns('authorId'),
  },
  { role: 'blocked', resource: 'posts', action: WILDCARD, effect: 'deny', priority: 100 },
  { role: ANONYMOUS, resource: 'posts', action: 'read', effect: 'allow' },
  { role: WILDCARD, resource: 'status', action: 'read', effect: 'allow' },
]);

const principal = { id: 'u1', roles: ['editor'] };

const bound = permit.forUser(principal);

permit.can(principal, 'posts', 'read');
permit.can(principal, 'posts', 'update', { authorId: 'u1' });
bound.can('status', 'read');
bound.canAll('posts', ['read', 'update'], { authorId: 'u1' });
bound.explain('posts', 'update', { authorId: 'u2' });

Documentation

• Overview
• Usage Guide
• API Reference
• Examples

License

MIT © Helmuth Saatkamp — part of the Vielzeug monorepo.