permission-core
    • v3.0.0 Stable

    permission-core

    Authorization that reaches the data layer

    Use one tenant-aware RBAC model to control Node.js APIs, menus, data rows, and fields.

    10-minute Quick StartView Runnable Examples
    Authorization flow from identity through roles to application resourcesAuthorization flow from identity through roles to application resources

    MonSQLize 3.1 persistence

    Reuse the application's connected MonSQLize runtime to persist roles, rules, revisions, audit evidence, and real transactions.

    Complete admin permissions

    Manage menus, pages, buttons, API bindings, and role grants, then project a safe visible tree for each user.

    Row and field coordination

    Automatically compose Mongo-style business filters with tenant scope, rule conditions, and read/write field permissions.

    Real tenant isolation

    Every read, write, cache key, and audit record carries scope so reused user and role IDs remain isolated by tenant.

    Native Vext plugin

    Consume route permissions and trusted auth context, join lifecycle hooks, and require restart after route manifest changes.

    Observable and default-deny

    Support production operations through revisions, previews, audit IDs, health state, bounded responses, and explicit recovery paths.