Authorization for entire TypeScript stack

import { createMongoAbility, AbilityBuilder } from '@casl/ability';
import { accessibleBy } from '@casl/mongoose';

// Define permissions once
const { can, cannot, build } = new AbilityBuilder(createMongoAbility);

can('read', ['Post', 'Comment']);
can('manage', 'Post', { author: 'me' });
can('create', 'Comment');

const ability = build();

// Enforce them across your application
ability.can('read', 'Post') // UI & API
accessibleBy(ability, 'update').ofType('Post') // Database conditions

Built with CASL

Using CASL? Add your project

Isomorphic

Use the same authorization rules across frontend and backend, with integrations for popular frameworks and ORMs.

Versatile

From simple claim-based checks to action/resource permissions, supporting both RBAC and fine-grained ABAC.

Serializable

Define permissions once. Serialize and share rules across frontend, APIs, and microservices.

TypeSafe

TypeScript-first APIs catch mistakes early and provide a better developer experience.

Tree shakable

Just 6.7kB minified and gzipped, with tree shaking to keep bundles even smaller.