identity and trustpackages/iam/permissions
permissions package
RBAC + ABAC engine — CASL for in-process checks, OpenFGA for Zanzibar-style relationships. defineAbility() server, <Can /> in React.
- Stability
- Stable
- Scope
- Tenant-scoped
- Boundary
- packages/iam/permissions
RBAC · ABAC
| Resource | read | write | delete | manage |
|---|---|---|---|---|
| Project | ||||
| Billing | ||||
| Audit log | ||||
| API key | ||||
| Team member |
Powered by CASL · evaluated server-side
Usagepermissions.ts
typescriptpermissions.ts
1import { defineAbility } from "@nebutra/permissions";
2
3const ability = defineAbility((can, cannot, user) => {
4 if (user.role === "admin") can("manage", "all");
5 can("read", "Post", { tenantId: user.tenantId });
6 can("update", "Post", { authorId: user.id });
7 cannot("delete", "Post", { isPublished: true });
8});
9
10ability.can("update", post);