node package manager



npm version Build Status Coverage Status Dependency Status

The RBAC core from hapi-rbac

This is inspired by the XACML policies.


How to use it

First, install

npm install --save rbac-core

Import it to your project

const Rbac = require('rbac-core');
const DataRetrievalRouter = Rbac.DataRetrievalRouter;

Create your data sources in the data retrieval router

const dataRetrieverRouter = new DataRetrievalRouter();
 * register(prefixes, dataretriever): registers a data retriever.
 * prefixes - a string or array of strings with prefixes which this data retriever will be associated
 * dataretriever - a function with the following signature
 *         source - The requested prefix
 *         key - the key being requested
 *         context - An object with contextual information
dataRetrieverRouter.register('credentials', (source, key, context) => {
    // Obtain your value (e.g. from the context) 
    const value = context.user[key];
    return value;
// You can handle multiple prefixes with a single data retriever 
dataRetrieverRouter.register(['connection', 'status'], (source, key, context) => {
    let value;
    switch (source) {
        case 'connection':
            // Obtain connection info 
            value = context.connection[key];
        case 'status':
            // Obtain from somewhere else 
            value = getStatusValue(key);
    return value;

Evaluate your policies against a certain context

const context = {
    user: {
        username: 'francisco',
        group: ['articles:admin', 'articles:developer'],
        validated: true,
        exampleField1: "test-value"
    connection: {
        remoteip: '',
        remoteport: 90,
        localip: ''
        localport: 80,
        exampleField2: "test-value"
const policy = {
    target: [
        // if username matches 'francisco' OR (exampleField1 matches exampleField2 AND user group matches 'articles:*') 
        { 'credentials:username': 'francisco' },
        // OR 
            'credentials:exampleField1': { field: 'connection:exampleField2' }
            // AND 
            'credentials:group': /^articles\:.*$/ //(using native javascript RegExp) 
    apply: 'deny-overrides', // permit, unless one denies 
    rules: [
            target: { 'credentials:group': 'articles:admin', 'credentials:validated': false }, // if group is 'articles:admin' AND is not validated 
            effect: 'deny'  // then deny (deny access to users that are not validated) 
            target: { 'connection:remoteip': ['', ''] }, // if remoteip is one of '' or '' 
            effect: 'deny'  // then deny (deny blacklisted ips) 
            effect: 'permit' // else permit 
Rbac.evaluatePolicy(policy, dataRetrieverRouter, (err, result) => {
    switch (result) {
        case Rbac.PERMIT:
            console.log('ACCESS GRANTED');
        case Rbac.DENY:
            console.log('ACCESS DENIED');

If you want to extend your existent data retriever router, you can do it.

// You can just extend 
const dataRetrieverRouter1 = dataRetrieverRouter.createChild();
// You can also directly add context to the extension, for isolation 
const dataRetrieverRouter2 = dataRetrieverRouter.createChild(context);

Both dataRetrieverRouter1 and dataRetrieverRouter2 will have all the registered data retrievers from dataRetrieverRouter.

Changes to dataRetrieverRouter will influence dataRetrieverRouter1 and dataRetrieverRouter2.

Changes to any of dataRetrieverRouter1 or dataRetrieverRouter2 will not cause influence on any data retriever routers, but themselves.

Contexts are preserved per data retriever router.

You can also get data from data retriever router

dataRetrieverRouter.get('credentials:username', (err, result) => {

And you can override the context on get, by passing it in the second argument

dataRetrieverRouter.get('credentials:username', { username: 'the_overrider', group: ['anonymous'] }, (err, result) => {

Learn more about Rule Based Access Control

To have a better idea of how this works, you can check my Bachelor's project presentation about XACML here (english), or here (portuguese).

Even though this plugin doesn't implement the XACML specification, it was based on its policies.