@auth-gate/rbac 0.9.3 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +117 -0
- package/icon.png +0 -0
- package/package.json +4 -3
package/README.md
ADDED
|
@@ -0,0 +1,117 @@
|
|
|
1
|
+
<p align="center">
|
|
2
|
+
<img src="icon.png" alt="AuthGate" width="120" height="120" />
|
|
3
|
+
</p>
|
|
4
|
+
|
|
5
|
+
# @auth-gate/rbac
|
|
6
|
+
|
|
7
|
+
RBAC as code for [AuthGate](https://www.authgate.dev) — define resources, roles, and permissions in TypeScript and sync them with a single CLI command.
|
|
8
|
+
|
|
9
|
+
## Installation
|
|
10
|
+
|
|
11
|
+
```bash
|
|
12
|
+
npm install @auth-gate/rbac
|
|
13
|
+
```
|
|
14
|
+
|
|
15
|
+
## Quick Start
|
|
16
|
+
|
|
17
|
+
### 1. Generate a starter config
|
|
18
|
+
|
|
19
|
+
```bash
|
|
20
|
+
npx @auth-gate/rbac init
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
### 2. Define your RBAC config
|
|
24
|
+
|
|
25
|
+
```ts
|
|
26
|
+
// authgate.rbac.ts
|
|
27
|
+
import { defineRbac } from "@auth-gate/rbac";
|
|
28
|
+
|
|
29
|
+
export const rbac = defineRbac({
|
|
30
|
+
resources: {
|
|
31
|
+
documents: { actions: ["read", "write", "delete"] },
|
|
32
|
+
billing: { actions: ["read", "manage"] },
|
|
33
|
+
},
|
|
34
|
+
roles: {
|
|
35
|
+
admin: {
|
|
36
|
+
name: "Admin",
|
|
37
|
+
grants: {
|
|
38
|
+
documents: { read: true, write: true, delete: true },
|
|
39
|
+
billing: { read: true, manage: true },
|
|
40
|
+
},
|
|
41
|
+
},
|
|
42
|
+
member: {
|
|
43
|
+
name: "Member",
|
|
44
|
+
isDefault: true,
|
|
45
|
+
grants: {
|
|
46
|
+
documents: { read: true, write: true },
|
|
47
|
+
},
|
|
48
|
+
},
|
|
49
|
+
viewer: {
|
|
50
|
+
name: "Viewer",
|
|
51
|
+
grants: {
|
|
52
|
+
documents: { read: true },
|
|
53
|
+
},
|
|
54
|
+
},
|
|
55
|
+
},
|
|
56
|
+
});
|
|
57
|
+
```
|
|
58
|
+
|
|
59
|
+
### 3. Sync to AuthGate
|
|
60
|
+
|
|
61
|
+
```bash
|
|
62
|
+
export AUTHGATE_API_KEY=ag_...
|
|
63
|
+
export AUTHGATE_BASE_URL=https://www.authgate.dev
|
|
64
|
+
|
|
65
|
+
npx @auth-gate/rbac diff # Preview changes
|
|
66
|
+
npx @auth-gate/rbac sync # Apply changes
|
|
67
|
+
```
|
|
68
|
+
|
|
69
|
+
## Type Safety
|
|
70
|
+
|
|
71
|
+
`defineRbac()` validates grants at compile time. Referencing an undeclared resource or action is a TypeScript error.
|
|
72
|
+
|
|
73
|
+
```ts
|
|
74
|
+
rbac.resources.documents.key // "documents"
|
|
75
|
+
rbac.resources.documents.actions.read // "documents:read"
|
|
76
|
+
rbac.roles.admin.key // "admin"
|
|
77
|
+
rbac.permissions.documents.write // "documents:write"
|
|
78
|
+
```
|
|
79
|
+
|
|
80
|
+
## CLI Commands
|
|
81
|
+
|
|
82
|
+
| Command | Description |
|
|
83
|
+
|---------|-------------|
|
|
84
|
+
| `npx @auth-gate/rbac init` | Generate a starter config file |
|
|
85
|
+
| `npx @auth-gate/rbac diff` | Preview changes without applying |
|
|
86
|
+
| `npx @auth-gate/rbac sync` | Apply changes to AuthGate |
|
|
87
|
+
| `npx @auth-gate/rbac pull` | Pull server state into a local config |
|
|
88
|
+
|
|
89
|
+
## Features
|
|
90
|
+
|
|
91
|
+
- **Type-safe grants** — compile-time validation of resources, actions, and roles
|
|
92
|
+
- **Role inheritance** — roles can inherit permissions from other roles via `inherits`
|
|
93
|
+
- **Rename migrations** — rename roles without losing assignments via `renamedFrom`
|
|
94
|
+
- **Conditional grants** — attach condition functions to grant values
|
|
95
|
+
- **Default role** — mark one role as `isDefault: true` for new org members
|
|
96
|
+
- **Diff before sync** — preview all changes before they're applied
|
|
97
|
+
- **Coexists with dashboard** — roles created in the dashboard are preserved
|
|
98
|
+
|
|
99
|
+
## Runtime Role Management
|
|
100
|
+
|
|
101
|
+
```ts
|
|
102
|
+
import { createRoleManagement } from "@auth-gate/rbac";
|
|
103
|
+
|
|
104
|
+
const roles = createRoleManagement({
|
|
105
|
+
apiKey: process.env.AUTHGATE_API_KEY!,
|
|
106
|
+
baseUrl: process.env.AUTHGATE_BASE_URL!,
|
|
107
|
+
});
|
|
108
|
+
|
|
109
|
+
await roles.list();
|
|
110
|
+
await roles.create({ key: "editor", name: "Editor", permissions: ["documents:read", "documents:write"] });
|
|
111
|
+
await roles.update("editor", { name: "Content Editor" });
|
|
112
|
+
await roles.delete("editor");
|
|
113
|
+
```
|
|
114
|
+
|
|
115
|
+
## License
|
|
116
|
+
|
|
117
|
+
MIT
|
package/icon.png
ADDED
|
Binary file
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@auth-gate/rbac",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.10.0",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"exports": {
|
|
6
6
|
".": {
|
|
@@ -16,13 +16,14 @@
|
|
|
16
16
|
"module": "./dist/index.mjs",
|
|
17
17
|
"types": "./dist/index.d.ts",
|
|
18
18
|
"files": [
|
|
19
|
-
"dist"
|
|
19
|
+
"dist",
|
|
20
|
+
"icon.png"
|
|
20
21
|
],
|
|
21
22
|
"dependencies": {
|
|
22
23
|
"chalk": "^5.4.0",
|
|
23
24
|
"dotenv": "^17.2.4",
|
|
24
25
|
"jiti": "^2.4.0",
|
|
25
|
-
"@auth-gate/core": "0.
|
|
26
|
+
"@auth-gate/core": "0.10.0"
|
|
26
27
|
},
|
|
27
28
|
"devDependencies": {
|
|
28
29
|
"tsup": "^8.0.0",
|