VeguiPerms Express

@vperms/express adds request-scoped VeguiPerms abilities, permission middleware and an optional resolved-permission export endpoint to Express.

Express guide · API reference · GitHub

Install

npm install @vperms/express vperms express

Protect a route

import express from "express";
import { hasPermission, vpermsMiddleware } from "@vperms/express";
import { VeguiPermsMemoryAdapter } from "vperms";

const app = express();
const adapter = new VeguiPermsMemoryAdapter();

app.use(vpermsMiddleware({
  adapter,
  workspace: "workspace",
  resolver: () => null, // anonymous; replace with your authenticated subject ID
}));
app.get("/posts", hasPermission("posts.read"), (_req, res) => {
  res.json({ message: "You can read posts." });
});

Grant permissions through VeguiPermsService using the same adapter. Without a matching grant, the route is denied. The resolver accepts a subject ID, a Principal, or null; connect it to your authentication middleware.

hasPermission() requires every permission; hasAnyPermission() requires one. Enable permissionsExport to share authorized snapshots with client integrations.

Build and coverage badges describe the whole VeguiPerms repository. License: MIT.