Free tools Windows power users keep installed
One-click scans. No signup required.
permission-access is a small JavaScript library Alaa Samy describes for translating backend permission names into checks the UI can express as resource-and-action questions, such as whether someone can read Orders. In Samy’s account, the backend returned endpoint-shaped strings like Orders.GetAll_GET, while the dashboard needed to ask a semantic question. An optional action map bridges those vocabularies; without one, checks use literal permission names such as Orders.read.
Why endpoint-shaped permission strings were awkward in the UI
Samy describes building an internal admin dashboard with Next.js and Redux. Its backend permissions were named after endpoints—for example, Orders.GetAll_GET and Orders.Create_POST—rather than straightforward resource/action pairs such as orders.read.
As an Amazon Associate I earn from qualifying purchases.
That meant UI code had to know the backend’s naming. In Samy’s example, the dashboard needed to answer questions such as “can they read Orders?” If checks tied to backend identifiers were repeated across modules, a backend rename could be difficult to catch. His reference to checks appearing in “forty places” is an anecdote about that dashboard, not a measured industry statistic.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSamy describes the goal as letting the UI ask a semantic question without hardcoding the endpoint name chosen by the backend. The account is about UI checks; it does not establish that hiding or showing a control enforces authorization on the server.
#1 Best Overall
How the action map translates the two naming schemes
The central mechanism is an optional action map: it associates a UI-level action with one or more backend permission suffixes. In Samy’s example, read maps to suffixes such as GetAll_GET and GetList_GET. A call like checker.can("Orders", "read") can then check against a permission such as Orders.GetAll_GET.
Omit the map and, as the article describes it, the checker looks for the literal permission Orders.read. Samy also identifies REST_ACTION_MAP as an available REST-shaped preset; it is opt-in, not an assumed default. The choice is therefore between explicitly adapting backend-specific names and using literal semantic permission strings.
What the documented APIs look like
Samy presents a framework-agnostic core and a separate React-facing API. The following are examples from his article, not independently tested results.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Non-React checks
The core example uses createAccessChecker. Samy also shows convenience checks such as canRead, canCreate, and canUpdate, alongside the general can check. These let application code ask about an action without embedding endpoint suffixes at each call site.
React integration
For React, the documented interface includes PermissionsProvider, usePermissions, and a <Can> component. Samy’s example uses the component to render fallback content when a requested action is unavailable. These APIs address what the UI renders; they should not be treated as a replacement for server-side authorization.
What the library does not claim to handle
In the article’s publication context, Samy describes the package as version 0.1.x and says it had not been battle-tested outside his project. That is a historical description, not confirmation of the package’s current version, maintenance, or maturity.
- The documented checks return booleans; Samy says there is no explanation of why a permission was denied.
- He says the library does not provide wildcard permissions or feature flags.
- A discussion reply says it expects a flat, already-resolved permission list rather than resolving roles itself.
- Samy says there is no attribute-based access control (ABAC) support at that time.
These are the author’s stated scope and limitations at publication, not an independent security review or confirmation of current package behavior. The article does not establish production reliability or server-side enforcement properties.
Where permission-access fits
The library’s narrow purpose is to keep UI checks readable when permission strings are shaped around backend endpoints. Its action map is useful when an application wants calls such as “can read Orders?” while retaining backend-specific permission identifiers. If the permission list already uses literal resource/action names, the article’s described checker can be used without a map. The account does not compare this approach with other libraries or establish that the mismatch is common across software projects.
Source: Alaa Samy’s article and discussion on DEV Community.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
