UMS Authorization Client Plugin

Production-ready plug-and-play authorization SDK for plain JavaScript and Angular applications.

Install

npm install ums-auth-client

JavaScript Mode

<script src="https://ums-auth.qlotech.com/ums-auth-client.js"></script>
<script>
  // response should come from your backend-authenticated UMS login call
  UMS.init(loginResponse);

  if (UMS.hasPermission('GENERAL', 'CREATE')) {
    console.log('Create allowed');
  }

  if (UMS.hasPermission('GENERAL', 'EDIT').has('ai_access')) {
    console.log('AI feature enabled');
  }
</script>

Angular Mode

import { UmsAuthModule, UmsAuthService } from 'ums-auth-client/angular';

@NgModule({
  imports: [UmsAuthModule]
})
export class AppModule {}

constructor(private readonly ums: UmsAuthService) {}

ngOnInit() {
  this.ums.init(loginResponse);

  if (this.ums.hasPermission('GENERAL', 'CREATE')) {
    // allowed
  }
}

<button *umsCan="'GENERAL.CREATE'">Create</button>
<div *umsCan="'GENERAL.EDIT'; attr: 'ai_access'">AI Feature</div>
<div *umsCan="'GENERAL.EDIT_1'; attr: 'genapi'">GenAPI Feature</div>

SDK API

• UMS.init(loginResponse)
• UMS.hasPermission(moduleName, permissionCode)
• UMS.hasPermission(moduleName, permissionCode).has(attributeName)
• UMS.getUser()
• UMS.getModules()
• UMS.getPermissionMap()
• UMS.getTenantContext()
• UMS.reset()

UMS Login API Format

POST /ums/api/v1/auth/login
Content-Type: application/json
X-CLIENT-ID: <client-id>
X-CLIENT-SECRET: <client-secret>
X-CLIENT-CERT: <client-cert>

{
  "userId": "user1"
}

Example curl:

curl --request POST 'http://localhost:8080/ums/api/v1/auth/login' \
  --header 'Content-Type: application/json' \
  --header 'X-CLIENT-ID: client_xxxxx' \
  --header 'X-CLIENT-SECRET: secret_xxxxx' \
  --header 'X-CLIENT-CERT: certificate_value' \
  --data '{"userId":"user1"}'

After authentication, initialize once:

UMS.init(loginResponseFromBackend);

Permission Map Generated Internally

The SDK builds an indexed permission map from authorization.modules.

{
  GENERAL: {
    CREATE: {
      allowed: true,
      attributes: {}
    },
    EDIT: {
      allowed: true,
      attributes: {
        ai_access: true
      }
    },
    EDIT_1: {
      allowed: true,
      attributes: {
        genapi: true
      }
    }
  }
}

Behavior

• Missing permission returns false
• Existing permission with allowed=false returns false
• Existing and allowed permission returns a grant object with .has(attributeName)

Usage examples:

UMS.hasPermission('GENERAL', 'CREATE');
UMS.hasPermission('GENERAL', 'EDIT').has('ai_access');
UMS.hasPermission('GENERAL', 'EDIT_1').has('genapi');

Security Guidance

Never expose X-CLIENT-SECRET or X-CLIENT-CERT in frontend code.

Recommended flow:

1. Frontend calls your application backend login endpoint.
2. Backend injects UMS client credentials securely.
3. Backend calls UMS login API.
4. Backend returns login response to frontend.
5. Frontend calls UMS.init(response).

Multi-Tenant Support

The SDK preserves user context from login response (organizationId, applicationId, activeRole) via UMS.getTenantContext() and supports role-based and attribute-based checks.