title: Node JS and Access Control
body: <p>In my project I'm using RBAC <a href="https://onury.io/accesscontrol/" rel="nofollow noreferrer">Access Control</a>. I have created access-control directory with index.js inside, where I'm creating "grantsObject"</p>
  
  <pre><code>'use strict'
  
  const AccessControl = require('accesscontrol');
  
  let grantsObject = {
      admin: {
          // Extends user and can delete and update any video or post
  
          video: {
              'create:any': ['*'],
              'read:any': ['*'],
              'update:any': ['*'], // Admin privilege
              'delete:any': ['*']  // Admin privilege
          },
          post: {
              'create:any': ['*'],
              'read:any': ['*'],
              'update:any': ['*'], // Admin privilege
              'delete:any': ['*']  // Admin privilege
          }
  
      },
      user: {
          video: {
              'create:any': ['*'],
              'read:any': ['*']
          },
          post: {
              'create:any': ['*'],
              'read:any': ['*']
          }
      }
  };
  
  const ac = new AccessControl(grantsObject);
  
  module.exports = ac;
  </code></pre>
  
  <p>And later in route I'm requiring this object</p>
  
  <pre><code>var ac = require('../config/access-control');
  </code></pre>
  
  <p>To check privileges:</p>
  
  <pre><code>const permission = ac.can(req.user.userRole).readAny('post');
  if (!permission.granted) {
      return res.status(403).end();
  }
  </code></pre>
  
  <p>Everything is working fine, but my question is about "grantsObject". I would like to have better code organization. In my project I have many roles and code is becoming repetitive.</p>
  
  <p>Admin has kind of inheritance and just extends user privileges. Is there any way to avoid coping user privileges inside admin object?</p>