# @nixxie-cms/rbac

Role-based access control helpers for Nixxie CMS. Define roles and permissions once, then drop the
generated access functions straight into your list/field `access` config. Supports role
inheritance and `*` / `resource:*` wildcards. Zero dependencies.

```ts
import { createRbac } from '@nixxie-cms/rbac'

export const rbac = createRbac({
  roles: {
    admin: { permissions: ['*'] },
    editor: { permissions: ['post:create', 'post:read', 'post:update'] },
    author: { permissions: ['post:create', 'post:read'], inherits: [] },
    viewer: { permissions: ['post:read'] },
  },
  // defaults to session.data.role ?? session.role
  getRoles: session => session?.data?.role,
})
```

Use in a list:

```ts
import { list } from '@nixxie-cms/core'
import { allowAll } from '@nixxie-cms/core/access'
import { rbac } from './rbac'

export const Post = list({
  access: {
    operation: {
      query: rbac.permission('post:read'),
      create: rbac.permission('post:create'),
      update: rbac.permission('post:update'),
      delete: rbac.requireRole('admin'),
    },
  },
  // ...
})
```

Imperative checks work too: `rbac.can(session, 'post:update')`, `rbac.hasRole(session, 'admin')`.