iam surface
Auth, identity, permissions, tenancy, audit, and secrets
- Stability
- Stable
- Scope
- Tenant-scoped
- Boundary
- packages/iam
- Actor verified25 ms
- Tenant scope16 ms
- iam authorized22 ms
- Audit logged12 ms
Active sessions
794
Audit entries / day
26,558
Policy checks / s
70
1import { ability } from "@nebutra/permissions";
2import { requirePermission } from "@nebutra/permissions/server";
3
4await requirePermission("user.invite", { orgId });
5
6const can = ability(currentUser);
7if (can("delete", "Project", project)) {
8 await deleteProject(project.id);
9}audit
Hash-chained, SHA-256 append-only audit log for actor/tenant actions. SOC 2-grade tamper detection, streaming export, and replay-safe queries.
Exploreauth
Multi-provider auth — Clerk, Better Auth, or NextAuth. Same React surface, swap providers via preset config. MFA-enforced, session HMAC-signed.
Explorecaptcha
Bot challenge with Cloudflare Turnstile / hCaptcha / reCAPTCHA behind one verify() call. Server-side scoring, per-route enable, no third-party tracker on the client.
Exploreidentity
Shared actor primitive — usr_/svc_/api_ ID space, role/membership lookup, tenant attachment. The single identity object every iam package reads.
Exploreoauth-server
Stand up your own OAuth 2.1 / OIDC provider. Authorization code + PKCE, refresh rotation, third-party app consent, JWT issuance with 1h default TTL.
Explorepermissions
RBAC + ABAC engine — CASL for in-process checks, OpenFGA for Zanzibar-style relationships. defineAbility() server, <Can /> in React.
Exploretenant
Request-scoped tenant context via AsyncLocalStorage, with Prisma RLS bridge. One tenantId resolves through middleware and propagates the whole stack.
Explorevault
Application-layer envelope encryption for customer secrets — AES-256-GCM, per-tenant DEK, KMS-wrapped. Audit-logged read/decrypt, zero plaintext at rest.
Explore