This is AuthX. It's named AuthX because it's an "exchange" of sorts, consolidating identities from several upstream authorities into a single identity for downstream clients. AuthX uses the OAuth2 framework in both directions, and adds a robust access con
Last updated 2 months ago by mike-marcacci .
MIT · Repository · Bugs · Original npm · Tarball · package.json
$ cnpm install @authx/authx 
SYNC missed versions from official npm registry.


This is AuthX. It's named AuthX because it's an "exchange" of sorts, consolidating identities from several upstream authorities into a single identity for downstream clients. AuthX uses the OAuth2 framework in both directions, and adds a robust access control system, based on the AuthX scope spec.

Concepts | Development | Scopes


AuthX is designed for a scenario in which a RESOURCE needs to restrict access to all or part of its functionality. A CLIENT app, acting on behalf of a User can retreive an OAuth token from AuthX, which can be passed to the RESOURCE with any request.

║                  ┌───────────┐           ║
║                  │ AUTHORITY │           ║
║                  └─────┬─────┘           ║
║   ┌────────────┐ ┌─────┴─────┐           ║
║   │ Credential ├─┤ Authority │           ║
║   └───┬────────┘ └───────────┘           ║
║   ┌───┴──┐              Authentication   ║
║░░░│ User │░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░║
║   └─┬──┬─┘              ┌──────┐         ║
║     │  └────────────────┤ Role │         ║
║    ┌┴──────┐ ┌────────┐ └──────┘         ║
║    │ Grant ├─┤ Client │                  ║
║    └───────┘ └───┬────┘  Authorization   ║
║              ┌───┴────┐ ┌──────────┐     ║
║              │ CLIENT ├─┤ RESOURCE │     ║
║              └────────┘ └──────────┘     ║


A user is the central component, and represents a source of agency, either human or machine.


A resource is anything which requires an AuthX token to perform an action.


A client uses AuthX to act on behalf of a user.


A grant contains the set of scopes for which a client's can act on a user's behalf.


An authorization contains the set of scopes that will be encoded in a token and passed to a resource by a client.


A role bestows its scopes to every user it includes.


An authority is a mechanism for authentication, and provides the configuration for corresponding units of code called strategies. Several strategies are included by default:

  1. email - use an email address to verify a visitor's identity (most people call this "reset your password")
  2. password - verify your identity with a password (which is protected with bcrypt)
  3. openid - connect to an OpenID provider, such as Google


Credentials connect users to authorities. A user can have multiple credentials of the some authorities (multiple emails, for example), or be limited to one (such as a password).



These scripts can be run using npm run <script> or yarn <script>; when relevant, the following environment variables can be set to modify their behavior:

  • PORT: HTTP port to listen
  • PGHOST: postgres host
  • PGPORT: postgres port
  • PGUSER: postgres user
  • PGPASSWORD: postgres password


Use prettier to format the code in this package.


Check the contents of this package against prettier and eslint rules.


Build the files from /src to the /dist directory with optimizations.


Build the files from /src to the /dist directory, and re-build as changes are made to source files.


Start a web server that runs AuthX.


Start a web server that runs AuthX and reloads as its source files change. Use the PORT environment variable to specify a port.


Run all tests from the /dist directory.


Run all tests from the /dist directory, and re-run a test when it changes.



This holds the source code for AuthX.


The compiled and bundled code ends up here for distribution. This is ignored by git.


AuthX uses its own authorization system to restrict access to its resources. A scope is divided into three parts:

  1. realm: this is configurable to the individual instance (for example, authx or identity or authx.dev)
  2. context: this contains the criteria required for an action to be valid
  3. action: the action being performed


For an AuthX resource, the context is always in the following format:


When checking for the ability to perform an action on an entity, the entity's ID and the IDs of related entities are present on the compared scope. When creating a new entity, only the IDs of related entities will be present, and the position of the entity' ID will be empty, even if an ID is specified for the entity in its creation request.

Given an entity type, relevant IDs will be present in the context:

type authority_id authorization_id client_id credential_id grant_id role_id user_id
  • ○ An ID may be present.
  • ● An ID will always be present for an action.
  • ✪ An ID will be present for existing entities, and will be empty for a new entity.


For an AuthX resource, the action is always in the following format:


In each position, an r designates the ability to perform reads, a w designates the ability to write, and (per normmal scope semantics) a * designates both.

To create a new entity, a value of * is required in each relevant position. For example, the following scope represents the ability to create a new client:

type basic details scopes secrets users
  • ● An r will be checked for reads; a w will be checked for writes.
  • ✪ All other applicable positions will check for a corresponding r or w in this position.


Users must have the following scopes to use OAuth:


The following scopes are implicit in an OAuth request:


Scope Explanations

Current Tags

  • 3.1.0-alpha.11                                ...           latest (2 months ago)

51 Versions

  • 3.1.0-alpha.11                                ...           2 months ago
  • 3.1.0-alpha.10                                ...           5 months ago
  • 3.1.0-alpha.9                                ...           5 months ago
  • 3.1.0-alpha.8                                ...           5 months ago
  • 3.1.0-alpha.7                                ...           6 months ago
  • 3.1.0-alpha.6                                ...           6 months ago
  • 3.1.0-alpha.5                                ...           6 months ago
  • 3.1.0-alpha.4                                ...           7 months ago
  • 3.1.0-alpha.3                                ...           7 months ago
  • 3.0.0-alpha.2                                ...           7 months ago
  • 3.0.0-alpha.1                                ...           7 months ago
  • 2.0.7                                ...           7 months ago
  • 2.0.6                                ...           8 months ago
  • 2.0.5                                ...           8 months ago
  • 2.0.4                                ...           8 months ago
  • 2.0.3                                ...           8 months ago
  • 2.0.2                                ...           8 months ago
  • 2.0.1                                ...           8 months ago
  • 2.0.0                                ...           8 months ago
  • 2.0.0-beta.30                                ...           8 months ago
  • 2.0.0-beta.29                                ...           8 months ago
  • 2.0.0-beta.28                                ...           9 months ago
  • 2.0.0-beta.27                                ...           9 months ago
  • 2.0.0-beta.26                                ...           9 months ago
  • 2.0.0-beta.25                                ...           a year ago
  • 2.0.0-beta.24                                ...           a year ago
  • 2.0.0-beta.23                                ...           a year ago
  • 2.0.0-beta.22                                ...           a year ago
  • 2.0.0-beta.21                                ...           a year ago
  • 2.0.0-beta.20                                ...           a year ago
  • 2.0.0-beta.19                                ...           a year ago
  • 2.0.0-beta.18                                ...           a year ago
  • 2.0.0-beta.17                                ...           a year ago
  • 2.0.0-beta.16                                ...           a year ago
  • 2.0.0-beta.15                                ...           a year ago
  • 2.0.0-beta.14                                ...           a year ago
  • 2.0.0-beta.13                                ...           a year ago
  • 2.0.0-beta.12                                ...           a year ago
  • 2.0.0-beta.11                                ...           a year ago
  • 2.0.0-beta.10                                ...           a year ago
  • 2.0.0-beta.9                                ...           a year ago
  • 2.0.0-beta.7                                ...           a year ago
  • 2.0.0-beta.6                                ...           a year ago
  • 2.0.0-beta.5                                ...           a year ago
  • 2.0.0-beta.4                                ...           a year ago
  • 2.0.0-beta.3                                ...           a year ago
  • 2.0.0-beta.2                                ...           a year ago
  • 2.0.0-beta.1                                ...           a year ago
  • 2.0.0-alpha.12                                ...           a year ago
  • 2.0.0-alpha.11                                ...           a year ago
  • 2.0.0-alpha.10                                ...           a year ago
Maintainers (1)
Today 0
This Week 0
This Month 0
Last Day 0
Last Week 0
Last Month 0
Dependencies (24)
Dev Dependencies (9)

Copyright 2014 - 2016 © taobao.org |