Sign Up for Free

RunKit +

Try any Node.js package right in your browser

This is a playground to test code. It runs a full Node.js environment and already has all of npm’s 400,000 packages pre-installed, including rbac-core with all npm packages installed. Try it out:

var rbacCore = require("rbac-core")

This service is provided by RunKit and is not affiliated with npm, Inc or the package authors.

rbac-core v3.0.0

RBAC core from hapi-rbac


npm version Build Status Coverage Status Dependency Status

The RBAC core from hapi-rbac

This is inspired by the XACML policies.


How to use it

First, install

npm install --save rbac-core

Import it to your project

const Rbac = require('rbac-core');
const DataRetrievalRouter = Rbac.DataRetrievalRouter;

Create your data sources in the data retrieval router

const dataRetrieverRouter = new DataRetrievalRouter();

 * register(prefixes, dataretriever): registers a data retriever.
 * prefixes - a string or array of strings with prefixes which this data retriever will be associated
 * dataretriever - a function with the following signature
 *         source - The requested prefix
 *         key - the key being requested
 *         context - An object with contextual information
dataRetrieverRouter.register('credentials', (source, key, context) => {

    // Obtain your value (e.g. from the context)
    const value = context.user[key];

    return value;

// You can handle multiple prefixes with a single data retriever
dataRetrieverRouter.register(['connection', 'status'], (source, key, context) => {

    let value;

    switch (source) {
        case 'connection':
            // Obtain connection info
            value = context.connection[key];
        case 'status':
            // Obtain from somewhere else
            value = getStatusValue(key);

    return value;

Evaluate your policies against a certain context

const context = {
    user: {
        username: 'francisco',
        group: ['articles:admin', 'articles:developer'],
        validated: true,
        exampleField1: "test-value"
    connection: {
        remoteip: '',
        remoteport: 90,
        localip: ''
        localport: 80,
        exampleField2: "test-value"


const policy = {
    target: [
        // if username matches 'francisco' OR (exampleField1 matches exampleField2 AND user group matches 'articles:*')
        { 'credentials:username': 'francisco' },
        // OR
            'credentials:exampleField1': { field: 'connection:exampleField2' }
            // AND
            'credentials:group': /^articles\:.*$/ //(using native javascript RegExp)
    apply: 'deny-overrides', // permit, unless one denies
    rules: [
            target: { 'credentials:group': 'articles:admin', 'credentials:validated': false }, // if group is 'articles:admin' AND is not validated
            effect: 'deny'  // then deny (deny access to users that are not validated)
            target: { 'connection:remoteip': ['', ''] }, // if remoteip is one of '' or ''
            effect: 'deny'  // then deny (deny blacklisted ips)
            effect: 'permit' // else permit

Rbac.evaluatePolicy(policy, dataRetrieverRouter, (err, result) => {

    switch (result) {
        case Rbac.PERMIT:
            console.log('ACCESS GRANTED');
        case Rbac.DENY:
            console.log('ACCESS DENIED');

If you want to extend your existent data retriever router, you can do it.

// You can just extend
const dataRetrieverRouter1 = dataRetrieverRouter.createChild();

// You can also directly add context to the extension, for isolation
const dataRetrieverRouter2 = dataRetrieverRouter.createChild(context);

Both dataRetrieverRouter1 and dataRetrieverRouter2 will have all the registered data retrievers from dataRetrieverRouter.

Changes to dataRetrieverRouter will influence dataRetrieverRouter1 and dataRetrieverRouter2.

Changes to any of dataRetrieverRouter1 or dataRetrieverRouter2 will not cause influence on any data retriever routers, but themselves.

Contexts are preserved per data retriever router.

You can also get data from data retriever router

dataRetrieverRouter.get('credentials:username', (err, result) => {

And you can override the context on get, by passing it in the second argument

dataRetrieverRouter.get('credentials:username', { username: 'the_overrider', group: ['anonymous'] }, (err, result) => {

Learn more about Rule Based Access Control

To have a better idea of how this works, you can check my Bachelor's project presentation about XACML here (english), or here (portuguese).

Even though this plugin doesn't implement the XACML specification, it was based on its policies.

RunKit is a free, in-browser JavaScript dev environment for prototyping Node.js code, with every npm package installed. Sign up to share your code.
Sign Up for Free