hbac-wasm: Browser & Node.js

hbac-wasm provides WebAssembly bindings for the hbac-rs engine, bringing FreeIPA-style host-based access control to browser and Node.js environments through a JSON-based API.

Quick Start

import init, { HbacPolicyWasm } from 'hbac-wasm';

await init();

const policy = new HbacPolicyWasm();

// Add a rule allowing all users SSH access
policy.addRuleFromJson(JSON.stringify({
  name: "allow-ssh",
  user_category: "all",
  host_category: "all",
  services: ["sshd"],
  rule_type: "Allow",
  enabled: true
}));

// Check access
const allowed = policy.checkAccessJson(JSON.stringify({
  user: "alice",
  user_groups: ["admins"],
  targethost: "server.example.com",
  service: "sshd"
}));

console.log(allowed); // true

Rule Builder

Use HbacRuleBuilderWasm to construct rules without manual JSON:

import { HbacRuleBuilderWasm } from 'hbac-wasm';

const builder = new HbacRuleBuilderWasm("allow-web-admins");
builder.addUserGroups(JSON.stringify(["admins"]));
builder.hostCategoryAll();
builder.addServices(JSON.stringify(["httpd", "nginx"]));
builder.setEnabled(true);

const ruleJson = builder.buildJson();
policy.addRuleFromJson(ruleJson);

Request Builder

Build requests programmatically with HbacRequestWasm:

import { HbacRequestWasm } from 'hbac-wasm';

const request = new HbacRequestWasm("alice", "server.example.com", "sshd");
request.addUserGroups(JSON.stringify(["admins", "engineers"]));
request.addTargethostGroups(JSON.stringify(["production"]));

const json = request.toJson();
const allowed = policy.checkAccessJson(json);

Detailed Evaluation

Get matched and unmatched rule names for debugging:

const result = policy.evaluateDetailedJson(JSON.stringify({
  user: "alice",
  targethost: "server.example.com",
  service: "sshd"
}));

const detail = JSON.parse(result);
console.log(detail.allowed);           // true
console.log(detail.matched_rules);     // ["allow-ssh"]
console.log(detail.not_matched_rules); // []

Error Handling

All errors are structured JavaScript objects with type and message fields:

try {
  policy.addRuleFromJson("invalid json");
} catch (e) {
  console.log(e.type);    // "JsonError"
  console.log(e.message); // parsing error details
}

Error types: JsonError (malformed JSON), PolicyError (rule limit or conflict), ValidationError (invalid field values).

Differences from hbac-rs

• No JIT compilation (cranelift is excluded from WASM builds)
• Single-threaded only (HbacPolicyLocal backend, not HbacPolicy)
• JSON-based API instead of native Rust types

API Reference

See the full API listing in API Documentation.

For build instructions, see WebAssembly Builds.