check out https://casl.js.org/

I like some of the function of casl, but the semantics of the API are pretty rough. It doesn't lend to reading the code smoothly at all.

Aside from it's overly complex interface, this line of code is why I didn't want to use casl.

So, anytime you do can("update", subject("Post", postToBeUpdated)), the subject function (an alias for the setSubjectType function containing the line of code above), modifies the given postToBeUpdated object... UNLESS postToBeUpdated is an instance of a class named Post.

This is a pretty bad decision IMO. I guess if you wanted to avoid it, you could wrap subject so that you always pass it a fresh object, e.g. subject("Post", {...postToBeUpdated}), but it makes me wary of the rest of the code altogether and it's a library that would have to be called a lot.

https://github.com/sellerartifact/accesscontrol hi, We plan to maintain this repo and have merged several unmerged PRs