@web-ts-toolkit/access-router

ACL-aware Express routers and in-memory data services for Mongoose-backed APIs.

Installation

pnpm add @web-ts-toolkit/access-router express mongoose

Peer dependencies:

• express >= 5
• mongoose >= 8

Highlights

• generated model CRUD routers
• generated in-memory data routers
• access control, field permissions, and request-time hooks
• root batch router for grouped operations
• request validation adapters
• generated OpenAPI JSON and Swagger UI routes

Quick Start

import acl from '@web-ts-toolkit/access-router';

acl.setGlobalOptions({
  globalPermissions(req) {
    return req.headers.user === 'admin' ? ['isAdmin'] : [];
  },
});

const fruitRouter = acl.createDataRouter('fruit', {
  basePath: '/fruit',
  idField: 'id',
  operationAccess: { list: true, read: true },
  data: [{ id: 'apple', name: 'Apple', public: true }],
  permissionSchema: {
    id: true,
    name: 'isAdmin',
    public: true,
  },
});

const userRouter = acl.createRouter('User', {
  basePath: '/users',
});

const docsRouter = acl.createOpenApiRouter({
  title: 'Example API',
  version: '1.0.0',
});

Main Exports

Root entrypoint (@web-ts-toolkit/access-router):

• default export acl
• createAccessRuntime()
• createOpenApiRouter(...)
• combineRoutes(...)
• guard(...)
• RootRouter, ModelRouter, DataRouter
• validation adapters such as fromZod(...) and defineRequestSchema(...)

Subpath entrypoints:

• @web-ts-toolkit/access-router/advanced — runtime context and advanced internals
• @web-ts-toolkit/access-router/processors — field processors

Import styles

The package ships both a default export and named exports:

// default export (preferred for the runtime API)
import acl from '@web-ts-toolkit/access-router';

// named exports (useful when you only need specific helpers)
import { createOpenApiRouter, fromZod } from '@web-ts-toolkit/access-router';

Subpath import example

import { setGlobalOptions } from '@web-ts-toolkit/access-router';
import { copyAndDepopulate } from '@web-ts-toolkit/access-router/processors';

setGlobalOptions({
  globalPermissions(req) {
    return [];
  },
});

const depopulated = copyAndDepopulate({ items: [{ _id: 'a1', name: 'Apple' }] }, [{ src: 'items', dest: 'items' }]);

Documentation

Full package documentation lives in website/docs/packages/access-router/.

• live docs: https://web-ts-toolkit.pages.dev/docs/packages/access-router
• overview: website/docs/packages/access-router/index.mdx
• routing: website/docs/packages/access-router/routing.mdx
• configuration: website/docs/packages/access-router/configuration.mdx
• hooks: website/docs/packages/access-router/hooks.mdx
• validation: website/docs/packages/access-router/validation.mdx
• OpenAPI: website/docs/packages/access-router/openapi.mdx