Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
permission-access is Alaa Samy’s small JavaScript library for bridging endpoint-shaped backend permission strings and the resource-and-action questions a UI needs to ask. In Samy’s example, the backend provides Orders.GetAll_GET, while the interface wants to know whether a user can read Orders. An optional action map connects those two vocabularies.
Why backend permission names can be awkward in a UI
Samy describes building an internal admin dashboard with Next.js and Redux. Its backend permissions were named for endpoints, including Orders.GetAll_GET and Orders.Create_POST. But dashboard code needed to express intent: can this user read Orders, or create an order?
Without a translation layer, UI checks have to know the backend’s naming. Samy says that repeating such checks across dashboard modules made renames difficult to catch; he describes the scale as “forty places” in his own project, not as an industry-wide measure. His goal was to let the UI ask a semantic question without hardcoding the endpoint name. Read Samy’s account and discussion on DEV Community.
How the action map translates permission strings
The library’s central idea is an optional action map: associate a UI-level action with the backend permission suffixes that authorize it. In Samy’s example, read maps to GetAll_GET and GetList_GET. A check such as checker.can("Orders", "read") can then match a permission like Orders.GetAll_GET.
#1 Best Overall
This lets the interface use stable resource-and-action language while the mapping accounts for the backend’s endpoint-oriented names. The mapping is project-specific configuration, not automatic discovery of what an endpoint means.
With an action map
Supply a map when permission strings use names that differ from the UI’s semantic actions. Samy also describes an opt-in REST-shaped preset called REST_ACTION_MAP. It is not the default, so a project must choose to use it.
Without an action map
If no map is supplied, the checker uses a literal permission such as Orders.read. That is useful when the permission list already uses the same resource-and-action convention as the UI; it does not translate an endpoint name such as Orders.GetAll_GET.
Using the checker outside React
Samy documents a framework-agnostic core with no runtime dependencies. For non-React code, the article shows creating a checker with createAccessChecker and using checks such as canRead, canCreate, and canUpdate. These are the author’s documented API examples, not independently verified behavior.
A standalone checker can keep permission decisions out of components that do not need React. The action map remains the part that translates the project’s backend permission vocabulary into the actions the application asks about.
Using the React API
For React applications, Samy documents PermissionsProvider, usePermissions, and a <Can> component. The component can render fallback content when an action is unavailable, allowing an interface to show an alternate state rather than the protected UI element.
These are UI-level checks. Hiding or replacing a button does not establish that a server endpoint enforces authorization; server-side access control remains a separate responsibility.
What the library does not cover
The article presents a focused permission-checking abstraction, not a full authorization system. In its publication context, Samy says the library returns booleans and does not provide wildcard permissions, feature flags, or an explanation of why access was denied.
A discussion reply says the library expects a flat list of permissions that has already been resolved, rather than resolving roles itself. Samy also says there was no attribute-based access control (ABAC) support at that time. These describe the project as discussed in the article; they should not be treated as confirmed facts about the package today.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How much confidence should you place in it?
Samy described the package as version 0.1.x and said it had not been battle-tested outside his project when he wrote the article. This is a maker’s account, not an independent security review, a comparison with other libraries, or evidence of current maintenance or package maturity.
The design is most relevant when an application receives a flat permission list whose endpoint-derived names do not match the UI’s resource-and-action language. Whether it fits depends on the application’s permission model and on where authoritative authorization is enforced; the article does not establish those properties for other projects.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
