title: Access control lists for Single Page Apps
body: <p>I am trying to manage access permissions (Laravel and Backbone.js based SPA) on both roles &amp; subscription types. </p>
  
  <p>Although it is simple to control access to API endpoints based on the quoted criteria, I am not able to figure out how this can be done on frontend. What are the best practices on that?</p>
  
  <p>To sum up the problem, there are basically two things to resolve:</p>
  
  <ol>
  <li>How to render the menu.</li>
  <li>How to render the components on each screen.</li>
  </ol>
  
  <p>Optionally one could think about permitted routes too.
  Then, a good practice would be to only return from the backend the ACL for the user and determine from it which items to render in the menu and the screens (what will imply to write some kind of mapper between the ACL and the access control and rendering) or would it be better to return more specific information (e.g. the menu structure).</p>
  
  <p>Can I get any advice on this?</p>