Fine-Grained Authorization in NestJS Without the Boilerplate

A practical look at how permify-toolkit removes the friction of using Permify in a TypeScript and NestJS project.

Introduction

I have been working with NestJS for a few years now, and for most of that time, authorization was the part I dreaded.

Not authentication. That part is boring in a good way.

Authorization. The part where you have to answer:

"Can this specific user actually do this specific thing to this specific resource?"

...at runtime, correctly, without it becoming a maze of if statements scattered across your controllers.

I eventually landed on Permify as the answer. If you have not heard of it, Permify is an open-source, Google Zanzibar-inspired authorization service. You define your permission model as a schema, push it to the Permify server, and then check permissions over gRPC from your app.…