Alfiz Standalone: Complete Authorization, One Application

​

What standalone means

​

What you get

• Permission grammar and catalog. Declare every permission in code; template-literal types verify every call site at compile time
• Four enforcement points. Page gate, navigation visibility, server action, conditional UI; alfiz-verify proves coverage in CI
• Scoped grants with expiry. Grant a role or a permission pattern at any scope, optionally time-bound, with provenance on every row
• Groups and nested groups. User cohorts with union-only inheritance; cycle detection enforced on every parentage write
• Roles. Named bundles of permission patterns; forward-inclusive wildcards absorb future keys automatically
• Reporting hierarchy. A reports-to edge per user drives implicit groups (directs:<id>, orgof:<id>) usable as grant subjects and approval predicates
• Access requests with management-layer approvals. Requestable roles and scope types; multi-stage workflows; management-chain routing resolved against your locally-stored hierarchy
• Sessions and view-as. Typed per-request sessions, plus admin preview that intersects the actor with the previewed identity and attributes denials to the actor
• Permission metrics. An optional structured observation per check, an OpenTelemetry adapter, a local aggregator, and the revocation safeguard
• The headless permission tree. buildPermissionTree, toggleNode, and isNodeChecked: the wildcard-aware selection logic behind any role editor or grant picker you build, rendering from your catalog with no markup of its own
• Listing helpers. grantedScopes plus planListing and the SQL-fragment builders, so a permission-filtered list becomes one indexed query instead of a per-row check

​

The Application is the org root

​

Runtime checks never leave your application

// Checks are in-process. Nothing phones home.
await alfiz.can({ userId }, "docs.files.read", "docs.doc:123");
await alfiz.require({ userId }, "docs.files.update_file", "docs.doc:123");
await alfiz.can.fresh({ userId }, "docs.files.delete", "docs.folder:9"); // bypass cache

​

Setting up a standalone deployment

npm install @alfiz/core @alfiz/application

pnpm add @alfiz/core @alfiz/application

yarn add @alfiz/core @alfiz/application

import { defineCatalog } from "@alfiz/core";

export const catalog = defineCatalog({
  namespaces: ["docs"],
  permissions: {
    "docs.files.read":        { scopes: ["docs.folder", "docs.doc"] },
    "docs.files.update_file": { scopes: ["docs.folder", "docs.doc"] },
    "docs.files.delete":      { scopes: ["docs.folder"] }, // destructive: stands alone
  },
  scopeTypes: {
    "docs.folder": { parent: null },
    "docs.doc":    { parent: "docs.folder" },
  },
});

import { parentPointerResolver } from "@alfiz/core";
import { createApplication, memoryDriver } from "@alfiz/application";
import { catalog } from "./catalog";
import { db } from "../db";

export const storage = memoryDriver();  // swap for @alfiz/prisma in production

export const app = createApplication({
  catalog,
  storage,
  ancestry: parentPointerResolver((scope) => db.parentOf(scope)),
  orgRoot: true,                   // the default, shown here for clarity
});

import { createAlfizClient } from "@alfiz/core";
import { catalog } from "./catalog";
import { app } from "./app";

export const alfiz = createAlfizClient({ catalog, provider: app });

const snap = await alfiz.snapshot({ userId }); // one provider round-trip
snap.can("docs.files.read");                    // sync, safe inside .map()
snap.canAny("docs.*");                          // visibility only, never a gate
snap.holds("docs.files.update_file");           // "should this button exist at all"
await snap.resolve(rowScopes);                  // extend after querying

// When a user is deleted or offboarded:
await app.deleteSubject(`user:${userId}`, provenance);
// Reversible alternative, blocking all access until re-activated:
await app.setUserActive(userId, false, provenance);

// When a resource is deleted:
await app.deleteScope(`docs.doc:${docId}`, provenance);

// When a resource is moved:
app.notifyScopeMoved(`docs.doc:${docId}`); // busts cached ancestor chain immediately

​

Who standalone is right for

​

The growth path