futurechan / node_acl-mem-regexp

This replacement for the memory-backend that ships with node_acl supports regular expressions for the resource

Memory Backend with RegExp support for NODE ACL

This replacement for the memory-backend that ships with acl supports regular expressions for the resource.

##Status

##Installation

Using npm:

npm install acl-mem-regexp

##Examples

Explicitly allow access to a resource and its subresource.

var acl = require('acl')
    , Backend = require('acl-mem-regexp')
    , acl = new acl(new Backend())
;

acl.allow([
	{
		roles:['someRole'], 
		allows:[
			{resources:'/resource(/[0-9]+)?', permissions:['get', 'post', 'put']},
			{resources:'/resource/[0-9]+/subresource/[0-9]+', permissions:['get', 'post', 'put']}
		]
	}
])

Do not include ^ and $. Those will be added for you.

You can also omit access to the parent resource while allowing access to the subresource.

acl.allow([
	{
		roles:['someOtherRole'], 
		allows:[
			{resources:'/resource/[0-9]+/subresource/[0-9]+', permissions:['get', 'post', 'put']}
		]
	}
])

node_acl-mem-regexp's Issues

Prototype Pollution

Hi,
I am using acl-mem-regexp version ^0.2.0.
When I am running npm audit then it's showing, the package is vulnerable with the below details

Package lodash
Patched in >=4.17.11, >=4.17.12, >=4.17.19
Dependency of acl-mem-regexp
Path acl-mem-regexp > lodash

More info https://npmjs.com/advisories/782
More info https://npmjs.com/advisories/1065
More info https://npmjs.com/advisories/1523

Update lodash version

High Prototype Pollution
Package lodash
Patched in >=4.17.11
Dependency of acl-mem-regexp
Path acl-mem-regexp > lodash
More info

• https://npmjs.com/advisories/782
• https://npmjs.com/advisories/577
• https://npmjs.com/advisories/1065
• https://npmjs.com/advisories/1523

Support for real Regexp

Hi, nice work.

Is there any particular reason why plain/pure Regexp are not supported?

Looking at:

Do not include ^ and $. Those will be added for you.

I wonder why this is not possible:

acl.allow([
    {
        roles:['someRole'], 
        allows:[
            {resources:^\/resource(/[0-9]+)?$, permissions: ['get']},
            {resources:\/[0-9]+$, permissions: ['get']}, // all resources ending with `/:id`
        ]
    }
])

Let me know if this is worth my time investigating. I can submit a Pull request to add support for pure Regexp.

Cheers.