因为最近做的项目需要对一些资源做简单的权限管理。老项目用的是 node_acl。功能比较全，但是对于简单的 acl 也需要连数据库。于是就在想可不可以把 ACL 搞的简单一点。
对于简单的 ACL，表达的是 role是否被 allow对一个 resource做某个操作。
这其实可以使用一个三维矩阵来：
行代表 role列代表 resource第三维代表权限。
于是做了这个小库： acl-matrix
下面复制了下 readme, 欢迎讨论
Usage
- Install
npm install acl-matrix
- Require it
const AclMatrix = require('acl-matrix');
const roles = ['admin', 'member', 'guest'];
const resources = ['blog', 'comment'];
const allows = ['get', 'add', 'update', 'delete'];
// Each element in matrix stores the permissions of a role to a resource.
const matrix = [
// admin member guest
[[1, 1, 1, 1], [1, 0, 1, 1], [1, 0, 0, 0]], // blog
[[1, 1, 1, 1], [1, 1, 1, 1], [1, 1, 1, 0]], // comment
];
const acl = new AclMatrix(roles, resources, allows, matrix);
// 0
acl.isAllowed('member', 'blog', 'add');
// 1
acl.isAllowed('member', 'blog', 'get');
Concepts
rolesare the types of user trying to accessresourcesallowsdescribes the oprations user will need to domatrixdescribes theallowsrelation betweenrolesandresources;- third dimension of the matrix is an array of
0and1s, the length of array should equal toallows's. This array describes the permissions.
For example: in the above sample code, matrix[0][2] ([1, 0, 0, 0]) means the guest role is able to 'get' the 'blog' resource, but not others.
Parameter limits
- Row number of
matrixshould eauql toresourceslength; - Collum number of
matrixshould eauql torolelength; - Element number of
matrixshould eauql toallowslength;
Pros and Cons
Pros
node_acl is good, but it acquires database to store the acls. And it is relatively hard to mantain and update acl using node_acl.
Benefits of using acl-matrix:
- Three dimensional matrix is the simplest way to store acl;
- Simple to config and simple for future change;
- No dependency, acl matrix can be easily shared between frontend and backend;
- Performance: no database needed, checking permissions is justing reading elemet in array
Cons
- By using node_acl you are able to save relations between
usersandroles. You will need to store the role of the user youself usingacl-matrix - By default, permissions of each roles are fixed, which is suitable for most projects. But if you want to allow user define the acl, you will need to store multiple acl matrices
TODOs
Add more method for the class maybe?
