CASL – Flexible Authorization for Node.js / React Applications

import { AbilityBuilder, Ability } from '@casl/ability';

function defineAbilitiesFor(user) {
    const { can, cannot, build } = new AbilityBuilder(Ability);

    if (user.role === 'admin') {
        can('manage', 'all'); // full access
    } else {
        can('read', 'Product');
        cannot('delete', 'Product');
    }

    return build();
}

Check Permissions with CASL

Create an "ability" object based on the current user's roles/permissions

const ability = defineAbilitiesFor(currentUser);

// Check if the user has permission to "delete" a "Product"

if (ability.can('delete', 'Product')) {
    // allow action
} else {
    // deny access
}

In an Express middleware, this logic is often used to protect routes:

// Middleware to check permissions based on action and subject

function authorize(action, subject) {
    return (req, res, next) => {

        // Create ability based on the logged-in user
        const ability = defineAbilitiesFor(req.user); 
        if (ability.can(action, subject)) {

            // If allowed, proceed to the next middleware or route handler 
            return next();
        }
        res.status(403).send('Forbidden');
    };
}

Why CASL?

• Clear semantic permission rules (can/cannot)
• Works on both frontend and backend
• Easily supports complex conditions (field-level access, ownership, etc.)
• Keeps business logic clean and centralized

Conclusion

If you're building a system with multiple roles or complex permission rules, give CASL a try.
It helps you write clean, understandable, and reusable access control logic.

If you're seeking a reliable, long-term partner who values collaboration and shared growth, feel free to reach out to us here: Contact ISB Vietnam

[References]

https://casl.js.org/v6/en/