access-control-rbac

# Access Control & RBAC Implement secure access control systems with fine-grained permissions using RBAC, ABAC, or hybrid approaches. ## Access Control Models | Model | Description | Best For | |-------|-------------|----------| | RBAC | Role-based - users assigned to roles with permissions | Most applications | | ABAC | Attribute-based - policies evaluate user/resource attributes | Complex rules | | MAC | Mandatory - system-enforced classification levels | Government/military | | DAC | Discretionary - resource owners control access | File systems | | ReBAC | Relationship-based - access via entity relationships | Social apps | ## Node.js RBAC Implementation ```javascript class Permission { constructor(resource, action) { this.resource = resource; this.action = action; } matches(resource, action) { return (this.resource === '*' || this.resource === resource) && (this.action === '*' || this.action === action); } } class Role { constructor(name, permissions = [], parent = null) { this.name = name; this.permissions = permissions; this.parent = parent; } hasPermission(resource, action) { if (this.permissions.some(p => p.matches(resource, action))) return true; return this.parent?.hasPermission(resource, action) ?? false; } } class RBACSystem { constructor() { this.roles = new Map(); this.userRoles = new Map(); } createRole(name, permissions = [], parentRole = null) { const parent = parentRole ? ...