How is PermX different from CASL?

CASL reasons about abilities against subjects. PermX locks every permission to a fixed module.resource:field.action.scope coordinate, and ships those same coordinates to the UI as route / component / field ids. You get typed autocomplete, single-source renames, and no policy language on top.

Do I need MongoDB or Express to use PermX?

No. The core is storage- and framework-agnostic. Mongoose and Express ship as optional peers — the engine runs anywhere you can call a function. Bring Postgres, Prisma, Hono, Fastify, Bun.serve — implement one PermXDataProvider and you are wired.

What about row-level or ABAC-style rules?

Scope covers the common cases: all, own, team, department, self. For arbitrary predicates, wrap the authorize call in your resolver — PermX stays out of your query builder.

Is it safe to put permissions in a database?

Yes — that is the point. Roles, role-permissions, and UI mappings live in your own DB behind your own auth. PermX caches the graph per tenant, invalidates on write, and bounds DFS to depth 10 so a malformed inheritance tree cannot pin the event loop.

What is the migration path from flat-RBAC?

Start incremental. Map your existing permission strings to coordinates one module at a time with definePermissions(). PermX will coexist with flat checks until you are ready to flip the switch. Most teams migrate over two sprints.

Why does PermX have zero runtime dependencies?

Supply-chain risk and bundle weight. Auth is in your hot path on every request and every render — it should not pull a transitive tree you have not audited. Core is hand-written TypeScript with no imports outside the standard library.

Documentation.

Guides and reference for PermX — structured RBAC for Node.js and React. Permission keys carry meaning, roles inherit with cycle protection, and UI mappings ship on every permission so your backend and frontend share one vocabulary.

Guides

tutorial · 15 min
Getting Started
From zero to a working RBAC system in five steps. Install, define typed permissions, create the engine, protect routes, gate the UI.
Read guide →

API reference

Full API documentation lives in the repository README alongside the source. Both packages publish TypeScript types — install and your editor resolves signatures, JSDoc, and inline examples.

@permx/core README — engine, mongoose adapter, express middleware, DataProvider interface
@permx/react README — provider, gates, hooks, and store
Examples directory — Express, Hono, Next.js App Router, and a full React demo

Documentation.

Guides

Getting Started

API reference