title: Advanced Access Control Libraries
body: <p>I am interested in performing advanced access control for users to access resources within software systems. I work in healthcare IT and a younger me has frequently underestimated the complexity of <a href="http://healthcaresecprivacy.blogspot.com/2012/09/advanced-access-controls-to-support.html">role-based access control in healthcare</a>. But this question should apply to anyone with complex ACL requirements.</p>
  
  <p>For quite some time <a href="http://phpgacl.sourceforge.net/">php gacl</a> has been my go-to library for the purposes of handling the very complex ACL control issues inside Health IT systems. But I am now working more with javascript in general and node specifically. I have searched npm for libraries to do Access Control in a generalizable way. </p>
  
  <p>I would like to have support for defining actions rather than merely users and resources (3-tier instead of 2) and I would like to have user, action and resource groups, and by implication I would like to have ACL inheritance.</p>
  
  <p>The classic examples from <a href="http://phpgacl.sourceforge.net/manual.pdf">the Star Wars themed manual</a> to that library are rules like:</p>
  
  <ul>
  <li>All members of the crew have (visit, configure, and use) access to
  the guns, engines, cockpit and lounge, expect for chewie. </li>
  <li>All droids have (visit and use) access to the cockpit, but only R2D2 has
  configure access to the engines. </li>
  <li>Han has all types of access to all
  types of resources.</li>
  </ul>
  
  <p>The basic concepts here include the notion that you can make rules that apply to either groups of users(i.e. crew, passengers or droids) or individuals (Han, and Chewie), that you can have different types of access (visit, configure, use) or groups of access (maintence access = configure + repair + use) to different resources (engine and cockpit) which could also be grouped, (battle-stations = cockpit + guns).</p>
  
  <p>This allows for the configuration of extraordinarily complex access control rules, with relatively simple group-based administration. </p>
  
  <p>So far, I have seen nothing like this outside of php-gacl. I have taken a look at the wonderful javascript based ACL projects and all of them advertise simplicity and ease of use rather than comprehensiveness. This is also true of other typical php ACL libraries (i.e. <a href="http://framework.zend.com/manual/1.12/en/zend.acl.introduction.html">Zend ACL</a>) </p>
  
  <p>Is someone working on an "advanced ACL" project for node? Is there perhaps a much better approach that I should be looking for somewhere?</p>
  
  <p>php-gacl comes with three parts, one is a php-based admin GUI (that is admittedly over-complex), and an API for CRUD on the rules (that could be easily converted to a REST interface I think) and a very small file that provides ACL checking functionality.</p>
  
  <p>Technically, only the last type would need to be fully ported over to node in order for that software model to work? </p>
  
  <p>On a deeper level, I want to understand what approaches have been used successfully to handle this problem. How is this problem typically solved? Bonus points for those who effectively discuss this problem in terms of node/javascript and perhaps even a particular database approach (relational vs non-relational). I understand that there are lots of theoretical underpinnings for doing this right/wrong (i.e. lots of opinion over RBAC, vs ACL). What I want is something theoretically solid, or almost-solid that still "just works" from a library standpoint. I am focused on Javascript, but it would be nice to understand how other languages are practically solving this problem. </p>