accesscontrol VS django-guardian

You can mitigate the pain by using libraries like accesscontrol, express-rbac, django-guardian, etc., to manage authorization more declaratively. But making sure nothing leaks is still a significant challenge.

2- https://www.npmjs.com/package/accesscontrol https://github.com/onury/accesscontrol

I used nestjsx-crud in the api we prepared. This library makes CRUD operations very easy. However, there is no support on the authorization side. That's why I made use of the accesscontrol library, which can be easily integrated with both nestjs and refine.

Access-Control

not a big fan of DSL(s), I think it adds complexity to the code, checkout this library accesscontrol all the configuration is javascript objects and more maintainable I think.

I am going through the docs accesscontrol npm library and came across code to limit the user to only readOwn resources.

what do you think about this library accesscontrol. It seems easier to grasp with its fluent syntax and no custom DSL

You can mitigate the pain by using libraries like accesscontrol, express-rbac, django-guardian, etc., to manage authorization more declaratively. But making sure nothing leaks is still a significant challenge.

These pieces fit together very well and are sufficient for replacing most of the goodies Django provides. However, there's one piece missing. Django has a built-in permissions feature, but it's limited to model-level control, i.e., if a user or group has X access to model type Y. Many users have been using the popular django-guardian package to implement row-level permissions. It allows you to establish permissions between users/groups and objects, manages the underlying permission database tables, and provides APIs for configuring and checking such permissions.

https://github.com/django-guardian/django-guardian/issues?q=is%3Aopen+is%3Aissue+label%3ABug

Could use django-guardian for this instead: https://github.com/django-guardian/django-guardian

I was about to use django-guardian until I came across the following in the official documentation:

django-guardian for per object permissions