ybrodsky / express-acl

This is a express module that enables you to implement ACL with much ease

Express ACL

Express Access Control Lists (express-acl) enable you to manage the requests made to your express server. It makes use of ACL rules to protect your sever from unauthorized access. ACLs defines which user groups are granted access and the type of access they have against a specified resource. When a request is received against a resource, express-acl checks the corresponding ACL policy to verify if the requester has the necessary access permissions.

What are ACL rules

ACL is a set of rules that tell express-acl how to handle the requests made to your server against a specific resource. Think of them like road signs or traffic lights that control how your traffic flows in your app. ACL rules are defined in JSON or yaml syntax.

Example

[{
  "group": "user",
  "permissions": [{
    "resource": "users",
    "methods": [
      "POST",
      "GET",
      "PUT"
    ],
    "action": "allow"
  }]
}]

YAML syntax

- group: user
  permissions:
    - resource: users
      methods:
        - GET
        - POST
        - DELETE
      action: allow

The contents of this file will be discussed in the usage section

Installation

You can download express-acl from NPM

$ npm install express-acl

then in your project require express-acl

const acl =  require('express-acl');

or GitHub

$ git clone https://github.com/andela-thomas/express-acl.git

copy the lib folder to your project and then require nacl.js

const acl =  require('./lib/nacl');

Usage

Express acl uses the configuration approach to define access levels.

Configuration

First step is to create a file called nacl.json and place this in the root folder. This is the file where we will define the roles that can access our application, and the policies that restrict or give access to certain resources. Take a look at the example below.

[{
  "group": "admin",
  "permissions": [{
    "resource": "*",
    "methods": "*"
  }],
  "action": "allow"
  }, {
  "group": "user",
  "permissions": [{
    "resource": "users",
    "methods": [
      "POST",
      "GET",
      "PUT"
    ],
    "action": "deny"
  }]
}]

In the example above we have defined an ACL with two policies with two roles, user and admin. A valid ACL should be an Array of objects(policies). The properties of the policies are explained below.

Property	Type	Description
group	string	This property defines the access group to which a user can belong to e.g user, guest, admin, trainer. This may vary depending with the architecture of your application.
permissions	Array	This property contains an array of objects that define the resources exposed to a group and the methods allowed/denied
resource	string	This is the resource that we are either giving access to. e.g blogs for route /api/blogs, users for route /api/users. You can also specify a glob * for all resource/routes in your application(recommended for admin users only)
methods	string or Array	This are http methods that a user is allowed or denied from executing. ["POST", "GET", "PUT"]. use glob * if you want to include all http methods.
action	string	This property tell express-acl what action to perform on the permission given. Using the above example, the user policy specifies a deny action, meaning all traffic on route /api/users for methods GET, PUT, POST are denied, but the rest allowed. And for the admin, all traffic for all resource is allowed.

How to define effective ACL rules

ACLs define the way requests will be handled by express acl, therefore its important to ensure that they are well designed to maximise efficiency. For more details follow this link

Authentication

express-acl depends on the role of each authenticated user to pick the corresponding ACL policy for each defined user groups. Therefore, You should always place the acl middleware after the authenticate middleware. Example using jsonwebtoken middleware

  // jsonwebtoken powered middleware
  ROUTER.use(function(req, res, next) {
   const token = req.headers['x-access-token'];
    if (token) {
      jwt.verify(token, key, function(err, decoded) {
        if (err) {
          return res.send(err);
        } else {
          req.decoded = decoded;
          next();
        }
      });
    }
  });

  // express-acl middleware depends on the the role
  // the role can either be in req.decoded (jsonwebtoken)or req.session
  // (express-session)

  ROUTER.use(acl.authorize);

API

There are two API methods for express-acl.

config[type: function, params: config { filename,path, yml, encoding, baseUrl, rules}, response {}]

This methods loads the configuration json file. When this method it looks for nacl.json the root folder if path is not specified.

config

• filename: Name of the ACL rule file e.g nacl.json
• path: Location of the ACL rule file
• yml: when set to true means use yaml parser else JSON parser
• baseUrl: The base url of your API e.g /developer/v1
• rules: Allows you to set rules directly withour using config file.
• defaultRole : The default role to be assigned to users if they have no role defined.
• decodedObjectName: The name of the object in the request where the role resides.
• searchPath: The path in which to look for the role within the req object

  const acl = require('express-acl');

  // path not specified
  // looks for config.json in the root folder
  // if your backend routes have base url prefix e.g  /api/<resource>,  v1/<resource> ,
  // developer/v1/<resource>
  // specify it in the config property baserUrl {baseurl: 'api'} ,
  // {baseurl: 'v1'}, {baseurl: 'developer/v1'} respectively
  // else you can specify {baseurl: '/'} or ignore it entirely


  acl.config({
    baseUrl:'api'
  });

  // path specified
  // looks for ac.json in the config folder

  acl.config({
    filename:'acl.json',
    path:'config'
  });

  // When specifying path you can also rename the json file e.g
  // The above file can be acl.json or nacl.json or any_file_name.json

  acl.config({
	  rules: rulesArray
  });

  // When you use rules api, nacl will **not** to find the json/yaml file, so you can save your acl-rules with any Database;
  
// The default role alllows you to specify which role users will assumne if they are not assigned any
  acl.config({
    defaultRole: 'anonymous'
  });

  
// By default this module will look for role in decoded object, if you would like to change the name of the object, you can specify this with decodedObjectName property.

// As per the example below, this module will look for req.user.role as compared to default req.decoded.role.

  acl.config({
    decodedObjectName:'user'
  })

// You can also specify a deep path in which to look for the role, in case it's not inside the usual locations

  acl.config({
    searchPath: 'user.Role.name' //will search for role in req.user.Role.name
  })

Response

This is the custom error you would like returned when a user is denied access to a resource. This error will be bound to status code of 403

const acl = require('express-acl');

let configObject = {
    filename:'acl.json',
    path:'config'
};

let responseObject = {
  status: 'Access Denied',
  message: 'You are not authorized to access this resource'
};

acl.config(configObject, responseObject);

authorize [type: middleware]

This is the middleware that manages your application requests based on the role and acl rules.

app.get(acl.authorize);

unless[type:function, params: function or object]

By default any route that has no defined policy against it is blocked, this means you cannot access this route untill you specify a policy. This method enables you to exclude unprotected routes. This method uses express-unless package to achive this functionality. For more details on its usage follow this link express-unless

//assuming we want to hide /auth/google from express acl

app.use(acl.authorize.unless({path:['/auth/google']}));

Anytime that this route is visited, unless method will exlude it from being passed though our middleware.

N/B You don't have to install express-unless it has already been included into the project.

Example

Install express-acl

$ npm install express-acl

Create nacl.json in your root folder

[{
  "group": "user",
  "permissions": [{
    "resource": "users",
    "methods": [
      "POST",
      "GET",
      "PUT"
    ],
  "action": "allow"
  }]
}]

Require express-acl in your project router file.

const acl = require('express-acl');

Call the config method

acl.config({
  //specify your own baseUrl
  baseUrl:'/'
});

Add the acl middleware

app.use(acl.authorize);

For more details checkout the examples folder.

Contributions

Pull requests are welcome. If you are adding a new feature or fixing an as-yet-untested use case, please consider writing unit tests to cover your change(s). For more information visit the contributions page