Node Acl | Authorization for Dynamic Urls - node.js

Question

I am using node acl for authorization for my rest end points into my node app.
The the roles based authorization works perfectly fine for the below urls.
acl.allow([{
roles: ['user'],
allows: [{
resources: ['/books/v1/single'],
permissions: ['post'],
},
{
resources: ['/books/v1/book/list'],
permissions: ['get'],
},
]
},
{
roles: ['admin'],
allows: [{
resources: ['/books/v1/list'],
permissions: ['get'],
}
]
}]);
But when I try to add dynamic urls it does not works as expected and gives the error which meant as UnAuthorized Needs more permissions.
acl.allow([{
roles: ['user'],
allows: [{
resources: ['/books/v1/single'],
permissions: ['post'],
},
{
resources: ['/books/v1/book/list'],
permissions: ['get'],
},
]
},
{
roles: ['admin'],
allows: [{
resources: ['/books/v1/list'],
permissions: ['get'],
},
{
resources: ['/books/v1/user/:userID/book/:bookID'],
permissions: ['get', 'put', 'delete'],
},
{
resources: ['/users/v1/list'],
permissions: ['get'],
},
{
resources: ['/users/v1/:userId'],
permissions: ['get', 'post', 'put', 'delete'],
}
]
}]);
So it gives unauthorized error for rest endpoints for dynamic urls i.e. /users/v1/:userId or /books/v1/user/:userID/book/:bookID
Any way/method in which same can implemented using node-acl libraray.

Answer 1

That's because node acl does not actually support hierarchy. It is really just a flat list, so it is explicitly checking for the string to match the resource. This is just a fundamental problem with the package. Since all the functionality is contained in the middleware, and it just isn't extensible there is no way to do what you want with this package without making a change so that it accepts a custom handler to decide what to pass to the middleware check.
Here's an example of the relevant open issue from 2017-08. The lack of funcitonality here is exactly why solutions like PolicyServer and Authress exist which do handle wildcard middleware and dynamic resource hierarchies.