Access Weaver 🧵

Access Weaver is a lightweight, declarative authorization middleware for Express.js.
It helps you weave access control policies into your routes using simple, rule-based flows.

✨ Features

• 🔑 Declarative rules with allow / deny effects.

• 🎯 Resource-based access with wildcards (*).

• ⚡ Express.js middleware with simple setup.

• 🧩 Flexible targets (static or dynamic from req).

• 🧪 Easy to test with SuperTest and Jest.

📦 Installation

npm install access-weaver

or

yarn add access-weaver

⚡ Quick Start

1. Define Policies

Policies are collections of flow rules:

const allowInvoiceRead = [
    {
        effect: "allow",
        action: "invoice.read",
        target: "invoice:*",
    },
];

const denyInvoiceRead = [
    {
        effect: "deny",
        action: "invoice.read",
        target: "invoice:*",
    },
];

2. Attach Policies to Users

Attach policies to the req.user object:

app.use((req, _res, next) => {
        req.user = {
            id: "u1",
            
            // Use like this
            policies: allowInvoiceRead,
        };
        next();
    }
);

3. Protect Routes

Use the authorize middleware:

import express from "express";
import {authorize} from "access-weaver";

const app = express();
app.get(
    "/invoice/:id",
    authorize({
        action: "invoice.read",
        target: (req) => `invoice:${req.params.id}`, // -> always do this when getting single data so that if any policy restrict someone it would work automatically
    }),
    (req, res) => {
        res.json({data: `Invoice data for ${req.params.id}`});
    }
);

4. More Examples

Delete a User

app.delete(
    "/users/delete/:id",
    authorize({
        action: "users.delete",
        target: (req) => `users:${req.params.id}`,
    }),
    (req, res) => {
        res.json({data: `User deleted with id ${req.params.id}`});
    }
);

Read All Users

app.get(
    "/users",
    authorize({
        action: "users.read",
        target: () => `users:*`,
    }),
    (req, res) => {
        res.json({data: [{id: 1}, {id: 2}, {id: 3}]});
    }
);

Read Single User

app.get(
    "/users/:id",
    authorize({
        action: "users.read",
        target: (req) => `users:${req.params.id}`,
    }),
    (req, res) => {
        res.json({data: {userId: req.params.id}});
    }
);

🔒 Example Policies

| Policy Name | Action | Target | Effect | Description | | --- | --- | --- | --- | --- | | allowInvoiceRead | invoice.read | invoice:* | allow | Can read all invoices | | denyInvoiceRead | invoice.read | invoice:* | deny | Cannot read invoices | | allowInvoiceUpdate | invoice.update | invoice:* | allow | Can update invoices | | allowUserDeleteWithSpecificId | users.delete | users:101 | allow | Can delete only user with ID 101 | | allowDeleteAnyUser | users.delete | users:* | allow | Can delete any user | | allowUserGetAll | users.read | users:* | allow | Can read all users | | allowSingleUserRead | users.read | users:101 | allow | Can only read user with ID 101 |

🧪 Testing

import request from "supertest";

it("should allow invoice read when policy permits", async () => {
    const app = makeApp(allowInvoiceRead);
    const res = await request(app).get("/invoice/123");
    expect(res.status).toBe(200);
    expect(res.body).toEqual({data: "Invoice data for 123"});
});

🤝 Contributing

PRs and issues are welcome! 🎉
If you find a bug or want a feature, open an issue.

📜 License

MIT © 2025