Implement Zanzibar-inspired authorization with RBAC, ABAC, and ReBAC using O(1) indexed permission lookups instead of custom auth logic.
npm install @djpanda/convex-authzA Zanzibar-inspired authorization component that supports role-based, attribute-based, and relationship-based access control with O(1) indexed permission lookups. Define permissions, roles, and policies in code, then check access in any Convex function without rolling your own auth logic or managing permission tables.
## Features
| Feature | Description |
|--------|-------------|
| RBAC | Role-Based Access Control with scoped roles |
| ABAC | Attribute-Based Access Control with custom policies |
| ReBAC | Relationship-Based Access Control with graph traversal |
| O(1) Lookups | Pre-computed permissions for instant checks |
| Type Safety | Full TypeScript support with type-safe permissions |
| Audit Logging | Track all permission changes and checks |
| Scoped Permissions | Resource-level access control |
| Expiring Grants | Time-limited role assignments and permissions |
| Convex Native | Built specifically for Convex, with real-time updates |
convex-authz provides RBAC with scoped roles that can be assigned at resource levels. Define roles in code, assign them to users with optional expiration times, then check permissions in any Convex function with simple API calls.
The component supports ABAC through custom policies that evaluate user attributes, resource properties, and contextual data. Write policy functions that return boolean results, then apply them to permission checks without managing complex permission tables.
convex-authz implements ReBAC with graph traversal for permissions based on relationships between users and resources. Define parent-child relationships, ownership patterns, and hierarchical access that automatically propagates through your data model.
The component pre-computes permissions into indexed tables for O(1) lookup performance. Instead of running complex queries on each permission check, it maintains computed permission states that update automatically when roles or relationships change.
convex-authz pre-computes all permissions into indexed Convex tables instead of calculating them at query time. When roles, relationships, or policies change, the component updates the computed permissions in the background, allowing instant permission checks without complex joins or graph traversals.
Yes, convex-authz works alongside any Convex authentication system including Convex Auth, Clerk, or custom implementations. The component focuses on authorization decisions after users are authenticated, integrating with your existing user identity system.
convex-authz supports all three models: RBAC assigns predefined roles to users, ABAC evaluates custom policies based on attributes, and ReBAC grants permissions through relationships like ownership or hierarchy. You can combine these approaches within the same application for flexible access control.
The component supports time-limited role assignments and permissions that automatically expire. Set expiration timestamps when granting roles or permissions, and convex-authz will automatically revoke access when the time limit is reached, updating the computed permission indexes accordingly.
Yes, convex-authz includes built-in audit logging that tracks all permission changes, role assignments, and access checks. The audit trail records who made changes, when they occurred, and what permissions were affected, supporting compliance requirements and security investigations.