{"id":18715164,"url":"https://github.com/cerbos/express-prisma-cerbos","last_synced_at":"2025-06-22T23:06:46.143Z","repository":{"id":37862512,"uuid":"401296635","full_name":"cerbos/express-prisma-cerbos","owner":"cerbos","description":"An example application of integrating Cerbos with an Express server using Prisma as the ORM.","archived":false,"fork":false,"pushed_at":"2025-06-16T08:02:23.000Z","size":548,"stargazers_count":11,"open_issues_count":2,"forks_count":2,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-06-22T11:16:21.610Z","etag":null,"topics":["cerbos","express","node","prisma"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cerbos.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-08-30T10:02:34.000Z","updated_at":"2025-06-16T07:51:54.000Z","dependencies_parsed_at":"2023-10-02T05:32:37.151Z","dependency_job_id":"47decee2-00db-47df-b0a7-8caa2e1bd4e4","html_url":"https://github.com/cerbos/express-prisma-cerbos","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/cerbos/express-prisma-cerbos","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cerbos%2Fexpress-prisma-cerbos","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cerbos%2Fexpress-prisma-cerbos/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cerbos%2Fexpress-prisma-cerbos/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cerbos%2Fexpress-prisma-cerbos/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cerbos","download_url":"https://codeload.github.com/cerbos/express-prisma-cerbos/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cerbos%2Fexpress-prisma-cerbos/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":261380908,"owners_count":23149966,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cerbos","express","node","prisma"],"created_at":"2024-11-07T13:07:48.568Z","updated_at":"2025-06-22T23:06:41.126Z","avatar_url":"https://github.com/cerbos.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# express-prisma-cerbos\n\nAn example application of integrating [Cerbos](https://cerbos.dev) with an [Express](https://expressjs.com/) server using [Prisma](https://prisma.io/) as the ORM. Cerbos helps you super-charge your authorization implementation by writing context-aware access control policies for your application resources. Author access rules using an intuitive YAML configuration language, use your Git-ops infrastructure to test and deploy them and, make simple API requests to the Cerbos PDP to evaluate the policies and make dynamic access decisions.\n\nThis is based on the [REST API Express](https://github.com/prisma/prisma-examples/tree/latest/typescript/rest-express) example from Prisma.\n\n## Dependencies\n\n- Node.js\n- Docker for running the [Cerbos Policy Decision Point (PDP)](https://docs.cerbos.dev/cerbos/installation/container.html)\n\n## Getting Started\n\n1. Start up the Cerbos PDP instance docker container. This will be called by the express app to check authorization.\n\n```bash\ncd cerbos\n./start.sh\n```\n\n2. Install node dependencies\n\n```bash\nnpm install\n```\n\n3. Setup Prisma and seed the database\n\n```\nnpx prisma migrate dev --name init\n```\n\n4. Start the express server\n\n```bash\nnpm run dev\n```\n\n## Seed Users\n\nThe Prisma seed command will create the following users in the database. Authentication is done via Basic authentication using the following credentials. The Role and Department is loaded from the database after successful authentication.\n\n| ID  | Username | Password     | Role  | Department |\n| --- | -------- | ------------ | ----- | ---------- |\n| 1   | alice    | supersecret  | Admin | IT         |\n| 2   | john     | password1234 | User  | Sales      |\n| 3   | sarah    | asdfghjkl    | User  | Sales      |\n| 4   | geri     | pwd123       | User  | Marketing  |\n\n## Policies\n\nThis example has a simple CRUD policy in place for a resource kind of `contact` - like a CRM system would have. The policy file can be found in the `cerbos/policies` folder [here](https://github.com/cerbos/express-prisma-cerbos/blob/main/cerbos/policies/contact.yaml).\n\nShould you wish to experiment with this policy, you can \u003ca href=\"https://play.cerbos.dev/p/ygW612cc9c9xXOsOZjI40ovY2LZvXf43\" target=\"_blank\"\u003etry it in the Cerbos Playground\u003c/a\u003e.\n\n\u003ca href=\"https://play.cerbos.dev/p/ygW612cc9c9xXOsOZjI40ovY2LZvXf43\" target=\"_blank\"\u003e\u003cimg src=\"docs/launch.jpg\" height=\"48\" /\u003e\u003c/a\u003e\n\nThe [policy](./cerbos/policies/contact.yaml) expects one of two roles to be set on the principal - `admin` and `user` and an attribute which defines their department as either `IT`, `Sales` or `Marketing`.\n\nThese roles are authorized as follows:\n\n| Action   | Role: User                                  | Role: Admin |\n| -------- | ------------------------------------------- | ----------- |\n| `read`   | Only if department is `Sales`               | Y           |\n| `create` | Only if department is `Sales`               | Y           |\n| `update` | Only if they own the contact being accessed | Y           |\n| `delete` | Only if they own the contact being accessed | Y           |\n\n## Example Requests\n\n### Get all contact\n\nAs a Sales user =\u003e `200 OK`\n\n```\ncurl -i http://john:password1234@localhost:3000/contacts\n```\n\nAs a Marketing user =\u003e `403 Unauthorized`\n\n```\ncurl -i http://geri:pwd123@localhost:3000/contacts\n```\n\n### Get a contact\n\nAs a Sales user =\u003e `200 OK`\n\n```\ncurl -i http://john:password1234@localhost:3000/contacts/1\n```\n\nAs a Marketing user =\u003e `403 Unauthorized`\n\n```\ncurl -i http://geri:pwd123@localhost:3000/contacts/1\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcerbos%2Fexpress-prisma-cerbos","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcerbos%2Fexpress-prisma-cerbos","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcerbos%2Fexpress-prisma-cerbos/lists"}