{"id":13630131,"url":"https://github.com/beyonk-group/sapper-rbac","last_synced_at":"2025-10-09T23:34:40.342Z","repository":{"id":44034885,"uuid":"224192198","full_name":"beyonk-group/sapper-rbac","owner":"beyonk-group","description":"RBAC for Sapper","archived":false,"fork":false,"pushed_at":"2023-03-03T10:12:27.000Z","size":6258,"stargazers_count":81,"open_issues_count":4,"forks_count":7,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-09-01T01:03:01.260Z","etag":null,"topics":["api","rbac","role","sapper","security","ssr","svelte","sveltejs"],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/beyonk-group.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2019-11-26T12:54:33.000Z","updated_at":"2024-08-17T14:47:18.000Z","dependencies_parsed_at":"2023-01-31T14:00:41.395Z","dependency_job_id":"111c0421-3cca-45ae-941d-f26ec9457ed3","html_url":"https://github.com/beyonk-group/sapper-rbac","commit_stats":null,"previous_names":["beyonk-group/sapper-rbac","beyonk-adventures/sapper-rbac"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/beyonk-group/sapper-rbac","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/beyonk-group%2Fsapper-rbac","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/beyonk-group%2Fsapper-rbac/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/beyonk-group%2Fsapper-rbac/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/beyonk-group%2Fsapper-rbac/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/beyonk-group","download_url":"https://codeload.github.com/beyonk-group/sapper-rbac/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/beyonk-group%2Fsapper-rbac/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279002310,"owners_count":26083340,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-09T02:00:07.460Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api","rbac","role","sapper","security","ssr","svelte","sveltejs"],"created_at":"2024-08-01T22:01:31.107Z","updated_at":"2025-10-09T23:34:40.328Z","avatar_url":"https://github.com/beyonk-group.png","language":"JavaScript","funding_links":[],"categories":["JavaScript"],"sub_categories":[],"readme":"\u003ca href=\"https://beyonk.com\"\u003e\n    \u003cbr /\u003e\n    \u003cbr /\u003e\n    \u003cimg src=\"https://user-images.githubusercontent.com/218949/144224348-1b3a20d5-d68e-4a7a-b6ac-6946f19f4a86.png\" width=\"198\" /\u003e\n    \u003cbr /\u003e\n    \u003cbr /\u003e\n\u003c/a\u003e\n\n# RBAC for Sapper\n\n[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg)](http://standardjs.com) [![build-status](https://img.shields.io/github/workflow/status/beyonk-adventures/sapper-rbac/publish)](https://github.com/beyonk-adventures/sapper-rbac/) [![Svelte v3](https://img.shields.io/badge/svelte-v3-blueviolet.svg)](https://svelte.dev)\n\nRole-based access control for Sapper. Works on both the server-, and, client-side.\n\n# Install\n\nInstall as a dev dependency:\n\n```bash\nnpm install --save-dev @beyonk/sapper-rbac\n```\n\n# Usage\n\n## Define a set of route permissions in your application\n\n* For Sapper to work, `/client/.*` is automatically unrestricted.\n\n```js\nimport { Router } from '@beyonk/sapper-rbac'\n\nconst routes = new Router()\n  .unrestrict('/login.*')\n  .restrict('/admin/sales.*', [ 'admin', 'sales' ])\n  .restrict('/admin.*', ['admin'])\n  .restrict('.*', [ 'customer' ])\n  .build()\n\nexport default routes\n```\n\n## For the server-side\n\n```js\nimport { guard } from '@beyonk/sapper-rbac'\nimport routes from './my-routes.js'\n\nconst app = polka()\n  .use(\n    sessionMiddleware,\n    (req, res, next) =\u003e {\n      const options = {\n        routes,\n        deny: () =\u003e {\n          res.writeHead(302, { Location: '/login' })\n          return res.end()\n        },\n        grant: () =\u003e {\n          return sapper.middleware({\n            session: () =\u003e (res.user ? { user: res.user } : {})\n          })(req, res, next)\n        }\n      }\n\n      return guard(req.path, res.user, options)\n    }\n  )\n\n```\n\n### sessionMiddleware\n\nThis middleware adds a user object at `res.user` (or null if the request isn't authenticated). The only required attribute of this user is `scope` which contains a list of authentication scopes that the user has:\n\n```js\nfunction sessionMiddleware (req, res, next) {\n  res.user = {\n    scope: ['admin', 'other']\n  }\n\n  next()\n}\n```\n\n### deny\n\nFor cases where the user is denied access, call this function.\n\nThe deny function receives two parameters:\n\n```js\ndeny (path, scope) {\n  // path: /some/path - the path the user attempted to access\n  // scope: {\n  //  given: [ 'sales.view', 'booking.create' ] - the scopes the user has\n  //  required: [ 'admin.view' ] - the scopes the user required\n  // }\n}\n```\n\n### grant\n\nFor cases where the user is granted access, call this function.\n\n## For the client-side\n\nOn the client side, we integrate with the page store in the root `_layout.svelte`:\n\n```js\nimport routes from './my-routes.js'\nimport { guard } from '@beyonk/sapper-rbac'\nimport { tick } from 'svelte'\nimport { stores, goto } from '@sapper/app'\n\nconst { page, session } = stores()\n\nconst options = {\n  routes,\n  deny: () =\u003e goto('/login')\n  // we don't specify grant here, since we don't need to do anything.\n}\n\n// Listen to the page store.\npage.subscribe(async v =\u003e {\n  await tick() // let the previous routing finish first.\n  guard(v.path, $session.user, options)\n})\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbeyonk-group%2Fsapper-rbac","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbeyonk-group%2Fsapper-rbac","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbeyonk-group%2Fsapper-rbac/lists"}