Authorization for entire TypeScript stack

Source code
Star — npm — 
import { createMongoAbility, AbilityBuilder } from '@casl/ability';
import { accessibleBy } from '@casl/mongoose';

// Define permissions once
const { can, cannot, build } = new AbilityBuilder(createMongoAbility);

can('read', ['Post', 'Comment']);
can('manage', 'Post', { author: 'me' });
can('create', 'Comment');

const ability = build();

// Enforce them across your application
ability.can('read', 'Post') // UI & API
accessibleBy(ability, 'update').ofType('Post') // Database conditions

Adoption & Ecosystem

From reusable libraries to real-world applications.

Real-world projects using CASL

Using CASL? Showcase your project

Isomorphic

Use the same authorization rules across frontend and backend, with integrations for popular frameworks and ORMs.

Versatile

From simple claim-based checks to action/resource permissions, supporting both RBAC and fine-grained ABAC.

Serializable

Define permissions once. Serialize and share rules across frontend, APIs, and microservices.

TypeSafe

TypeScript-first APIs catch mistakes early and provide a better developer experience.

Tree shakable

Just 6.8kB minified and gzipped, with tree shaking to keep bundles even smaller.