App.jsx — @a11n-io/cerberus-reactjs
import { CerberusProvider, AccessGuard, useAccess } from '@a11n-io/cerberus-reactjs';
// 1. Wrap your app — one-time setup
function App() {
return (
<CerberusProvider
apiHost="https://cerberus-api.a11n.io"
socketHost="wss://cerberus-ws.a11n.io"
>
<ProjectDashboard />
</CerberusProvider>
);
}
// 2. Guard any UI element — real-time permission checks via WebSocket
function ProjectDashboard({ projectId }) {
return (
<div>
<h1>Project Overview</h1>
{/* Only users with 'edit' access see the edit button */}
<AccessGuard resourceId={projectId} action="edit">
<EditProjectButton />
<template slot="otherwise">
<span className="badge">View only</span>
</template>
</AccessGuard>
{/* Delete is restricted to admins */}
<AccessGuard resourceId={projectId} action="delete">
<DeleteProjectButton />
</AccessGuard>
</div>
);
}
// 3. Or use the hook for imperative logic
function ExportButton({ reportId }) {
const [canExport, setCanExport] = React.useState(false);
useAccess(reportId, 'export', setCanExport);
return canExport ? <button>Export CSV</button> : null;
}
App.vue — @a11n-io/cerberus-vuejs
<!-- main.js: register the plugin -->
import { createApp } from 'vue'
import CerberusPlugin from '@a11n-io/cerberus-vuejs'
import App from './App.vue'
createApp(App)
.use(CerberusPlugin)
.mount('#app')
<!-- App.vue: wrap with provider -->
<template>
<CerberusProvider
api-host="https://cerberus-api.a11n.io"
socket-host="wss://cerberus-ws.a11n.io"
>
<ProjectDashboard />
</CerberusProvider>
</template>
<!-- ProjectDashboard.vue: guard UI elements -->
<template>
<div>
<h1>Project Overview</h1>
<!-- Only users with 'edit' permission see this -->
<AccessGuard :resource-id="projectId" action="edit">
<EditProjectButton />
<template #otherwise>
<span class="badge">View only</span>
</template>
</AccessGuard>
<!-- Restrict destructive actions to admins -->
<AccessGuard :resource-id="projectId" action="delete">
<DeleteProjectButton />
</AccessGuard>
</div>
</template>
<script setup>
import { AccessGuard } from '@a11n-io/cerberus-vuejs'
import { useAccess } from '@a11n-io/cerberus-vuejs'
const props = defineProps({ projectId: String })
// Use the composable for programmatic checks
const canExport = ref(false)
useAccess(props.projectId, 'export', (granted) => {
canExport.value = granted
})
</script>
auth.go — github.com/a11n-io/go-cerberus
package main
import (
"context"
"net/http"
"os"
cerberus "github.com/a11n-io/go-cerberus"
)
// 1. Initialise the client once at startup
var client = cerberus.NewClient(
"https://cerberus-api.a11n.io",
os.Getenv("CERBERUS_API_KEY"),
os.Getenv("CERBERUS_API_SECRET"),
)
// 2. Guard any HTTP handler with a middleware
func RequireAction(action string, next http.HandlerFunc) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
resourceId := r.PathValue("id")
ctx := r.Context()
ok, err := client.HasAccess(ctx, resourceId, action)
if err != nil || !ok {
http.Error(w, "Forbidden", http.StatusForbidden)
return
}
next(w, r)
}
}
// 3. Bootstrap a new customer account atomically
func onUserSignup(ctx context.Context, accountId, userId, email, name string) error {
return client.Execute(accountId, userId,
cerberus.CreateResourceCmd(accountId, "", "Account"),
cerberus.CreateUserCmd(userId, email, name),
cerberus.CreateRoleCmd("Admin"),
cerberus.CreateRoleCmd("Member"),
cerberus.AssignRoleCmd("Admin", userId),
cerberus.CreateRolePermissionCmd("Admin", accountId, []string{"CanManage", "CanInvite", "CanDelete"}),
cerberus.CreateRolePermissionCmd("Member", accountId, []string{"CanView"}),
)
}
// Routes
func main() {
http.HandleFunc("GET /projects/{id}", RequireAction("view", getProject))
http.HandleFunc("PUT /projects/{id}", RequireAction("edit", updateProject))
http.HandleFunc("DELETE /projects/{id}", RequireAction("delete", deleteProject))
http.ListenAndServe(":8080", nil)
}
AuthService.java — io.a11n:java-cerberus
import io.a11n.cerberus.CerberusClient;
import io.a11n.cerberus.command.Command;
import io.a11n.cerberus.model.TokenPair;
// 1. Initialise the client (inject as a Spring bean, for example)
@Bean
public CerberusClient cerberusClient() {
return CerberusClient.newClient(
"https://cerberus-api.a11n.io",
System.getenv("CERBERUS_API_KEY"),
System.getenv("CERBERUS_API_SECRET")
);
}
// 2. Check access in your service or filter layer
@Service
public class AuthService {
private final CerberusClient cerberus;
public void requireAccess(String userId, String accountId,
String resourceId, String action) {
TokenPair token = cerberus.getUserToken(accountId, userId);
boolean allowed = cerberus.hasAccess(token, resourceId, action);
if (!allowed) {
throw new AccessDeniedException("Action '" + action + "' not permitted");
}
}
// 3. Bootstrap a new customer account atomically
public void onUserSignup(String accountId, String userId,
String email, String name) throws CerberusException {
cerberus.execute(accountId, userId,
Command.createResource(accountId, null, "Account"),
Command.createUser(userId, email, name),
Command.createRole("Admin"),
Command.createRole("Member"),
Command.assignRole("Admin", userId),
Command.createRolePermission("Admin", accountId, List.of("CanManage", "CanInvite", "CanDelete")),
Command.createRolePermission("Member", accountId, List.of("CanView"))
);
}
}
// 4. Protect a Spring MVC controller
@RestController
@RequestMapping("/projects")
public class ProjectController {
@PutMapping("/{id}")
public ResponseEntity<?> update(@PathVariable String id,
@AuthUser User user) {
authService.requireAccess(user.getId(), user.getAccountId(), id, "edit");
// ... your business logic
return ResponseEntity.ok().build();
}
}
