nest-authz

A access control library for NestJS which built on node-casbin.

Casbin is a powerful and efficient open-source access control library. It provides support for enforcing authorization based on various access control models like ACL, RBAC, ABAC. For detailed info, check out the official docs

How to use

Installation

$ npm install --save nest-authz

Define Access Control Model

Firstly, you should create your own casbin access control model. Checkout related docs if you have not.

Initialization

AuthZModule.register(options)

options is an object literal containing options.

model is a path string to the casbin model.
policy is a path string to the casbin policy file or adapter
enablePossession is a boolean that enables the use of possession (AuthPossession.(ANY|OWN|OWN_ANY)) for actions.
userFromContext (REQUIRED) is a function that accepts ExecutionContext(the param of guard method canActivate) as the only parameter and returns the user as either string, object, or null. The AuthZGuard uses the returned user to determine their permission internally.
enforcerProvider Optional enforcer provider
imports Optional list of imported modules that export the providers which are required in this module.

There are two ways to configure enforcer, either enforcerProvider(optional with imports) or model with policy

An example configuration which reads user from the http request.

import { TypeOrmModule } from '@nestjs/typeorm';

@Module({
  imports: [
    AuthZModule.register({
      model: 'model.conf',
      policy: TypeORMAdapter.newAdapter({
        type: 'mysql',
        host: 'localhost',
        port: 3306,
        username: 'root',
        password: 'password',
        database: 'nestdb'
      }),
      userFromContext: (ctx) => {
        const request = ctx.switchToHttp().getRequest();
        return request.user && request.user.username;
      }
    }),
  ],
  controllers: [AppController],
  providers: [AppService]
})

import { TypeOrmModule } from '@nestjs/typeorm';
import { ConfigModule, ConfigService } from './config.module';
import { AUTHZ_ENFORCER } from 'nest-authz';

@Module({
  imports: [
    ConfigModule,
    AuthZModule.register({
      imports: [ConfigModule],
      enforcerProvider: {
        provide: AUTHZ_ENFORCER,
        useFactory: async (configSrv: ConfigService) => {
          const config = await configSrv.getAuthConfig();
          return casbin.newEnforcer(config.model, config.policy);
        },
        inject: [ConfigService],
      },
      userFromContext: (ctx) => {
        const request = ctx.switchToHttp().getRequest();
        return request.user && {
          username: request.user.username, 
          isAdmin: request.user.isAdmin 
        };
      }
    }),
  ],
  controllers: [AppController],
  providers: [AppService]

The latter method of configuring the enforcer is preferred.

Checking Permissions

Using `@UsePermissions` Decorator

The @UsePermissions decorator is the easiest and most common way of checking permissions. Consider the method shown below:

  @Get('users')
  @UseGuards(AuthZGuard)
  @UsePermissions({
    action: AuthActionVerb.READ,
    resource: 'USER',
    possession: AuthPossession.ANY
  })
  async findAllUsers() {}

The findAllUsers method can not be called by a user who is not granted the permission to read any user.

The value of property resource is a magic string just for demonstrating. In the real-world applications you should avoid magic strings. Resources should be kept in the separated file like resources.ts

The param of UsePermissions are some objects with required properties action, and resource, and optionally possession, and isOwn.

action is an enum value of AuthActionVerb.
resource is a resource string or object the request is accessing.
possession is an enum value of AuthPossession. Defaults to AuthPossession.ANY if not defined.
isOwn is a function that accepts ExecutionContext(the param of guard method canActivate) as the only parameter and returns boolean. The AuthZGuard uses it to determine whether the user is the owner of the resource. A default isOwn function which returns false will be used if not defined.

In order to support ABAC models which authorize based on arbitrary attributes in lieu of simple strings, you can also provide an object for the resource. For example:

@UsePermissions({
  action: AuthActionVerb.READ,
  resource: {type: 'User', operation: 'single'},
  possession: AuthPossession.ANY
})
async userById(id: string) {}

@UsePermissions({
  action: AuthActionVerb.READ,
  resource: {type: 'User', operation: 'batch'},
  possession: AuthPossession.ANY
})
async findAllUsers() {}

You can define multiple permissions, but only when all of them satisfied, could you access the route. For example:

@UsePermissions({
  action: AuthActionVerb.READ,
  resource: 'USER_ADDRESS',
  possession: AuthPossession.ANY
}, {
  action; AuthActionVerb.READ,
  resource: 'USER_ROLES',
  possession: AuthPossession.ANY
})

Only when the user is granted both permissions of reading any user address and reading any roles, could he/she access the route.

Using `AuthZService`

While the @UsePermissions decorator is good enough for most cases, there are situations where we may want to check for a permission in a method's body. We can inject and use AuthZService which is a wrapper of the Casbin RBAC + Management API for that as shown in the example below:

import { Controller, Get, UnauthorizedException, Req } from '@nestjs/common';
import {
  AuthZGuard,
  AuthZService,
  AuthActionVerb,
  AuthPossession,
  UsePermissions
} from 'nest-authz';

@Controller()
export class AppController {
  constructor(private readonly authzSrv: AuthZService) {}

  @Get('users')
  async findAllUsers(@Req() request: Request) {
    let username = request.user['username'];
    // If there is a policy  `p, root, user, read:any` in policy.csv
    // then user `root` can do this operation

    // Using string literals for simplicity.
    const isPermitted = await this.authzSrv.hasPermissionForUser(username, "user", "read:any");
    if (!isPermitted) {
      throw new UnauthorizedException(
        'You are not authorized to read users list'
      );
    }
    // A user can not reach this point if he/she is not granted for permission read users
    // ...
  }
}

(Deprecated) Using `AuthZRBACService` or `AuthZManagementService`

The functionality provided by AuthZRBACService and AuthZManagementService has been unified in AuthZService, so these services will be removed in a later release.

We can inject and use AuthZRBACService or AuthZManagementService which are wrappers of the Casbin RBAC and Management APIs, respectively, as shown in the example below:

import { Controller, Get, UnauthorizedException, Req } from '@nestjs/common';
import {
  AuthZGuard,
  AuthZRBACService,
  AuthActionVerb,
  AuthPossession,
  UsePermissions
} from 'nest-authz';

@Controller()
export class AppController {
  constructor(private readonly rbacSrv: AuthZRBACService) {}

  @Get('users')
  async findAllUsers(@Req() request: Request) {
    let username = request.user['username'];
    // If there is a policy  `p, root, user, read:any` in policy.csv
    // then user `root` can do this operation

    // Using string literals for simplicity.
    const isPermitted = await this.rbacSrv.hasPermissionForUser(username, "user", "read:any");
    if (!isPermitted) {
      throw new UnauthorizedException(
        'You are not authorized to read users list'
      );
    }
    // A user can not reach this point if he/she is not granted for permission read users
    // ...
  }
}