IsAuthorized

IsAuthorized V2

Currently Maintained

Version 2.0.0

cSunix

last updated topic May 6, 2025

Early Release

This version has just been released. Potential issues may occur and there is currently a lack of integration for TypeScript and other programs. Please be patient and utilize the GitHub to report & contribute.

Clean, simple & fast way to handle your permissions in game.

Overview

IsAuthorized is a lightweight declarative-wrote library which allows for simple and fast permissions checking, reliable for a variety of projects. The library boasts customizable, and is easily accessible for all developer skill levels.

local IsAuthorized = require(path.to.isauthorized)

-- check if a player is in the main group OR is on the "Prisoner" team.
local PlayerHasPermissions = IsAuthorized(Player, { "Team:Prisoner", "Group:Main" })

if PlayerHasPermissions then
print("This user has permissions!")
end

This library has been created with large scale comparison in mind, with a focus on performance at the core of the package.

Installation

IsAuthorized is available for Wally, or can be downloaded manually using a CLI or through GitHub. It is suggested you install this through Wally. If you have never used Wally before, I advise you take a quick tutorial on it from their website.

Using Wally

You can install this library by inserting the following into your wally.toml file, and then running wally install via your CLI.

[]
IsAuthorized = "csunix/[email protected]"

Using a CLI

Not Using Wally?

Wally is a great tool for version contorl management; by not using Wally you will not have access to ease-of-access when upgrading your IsAuthorized version. If you are new to the concept of Rojo & Wally- we advise you to learn it! It will be super helpful in the long term.

You can directly install the IsAuthorized library through your CLI by querying to this website's files.

curl --output IsAuthorized.rbxm "https://projects.sunix.dev/libs/isauthorized/assets/isauthorized.rbxm"

Manually Download

You are able to manually download the IsAuthorized rbxm file through the Releases tab in the library's GitHub. Make sure to install the latest version.

API Reference

This library's API has been developed to be simplistic, compact; but powerful. The cost of the API is in the developer's hands. IsAuthorized uses a declarative API to ensure minimal resources, and does not overload functions with costly under-the-trunk code- allowing for full customization for the developer, and minimal resources used by the code.

IsAuthorized prides itself on this not only compact API, but its customization.

Set Up

In order to apply configuration to IsAuthorized, developers can create .auth lua files in order to configure settings within IsAuthorized.

To add groups to query, you simply add a Groups.auth.lua file anywhere in ReplicatedStorage.

return {
["Main"] = 1000000,
["Another Group"] = 1000000,
}

Core API

`IsAuthorized(...2)`

Parameters

1: Player type: Player
2: AuthQuery type: AuthQuery<AuthQueryString>

Returns

1: IsAuthorizedOrNot? type: boolean

Compiles and compares the authorization query based on the player's attributes, data and other provided features. Lightweight and fast- does not cache; perfected for large comparisons and plenty of options for customization.

`tostring(IsAuthorized, ...1<ST>)`

Parameters

1: ModuleAuthQuery type: ModuleScript

Returns

1: type: boolean

Used internally to stringify ModuleScripts for reading authorization queries.

`IsAuthorized#EvaluateQuery(...2)`

Parameters

1: Player type: Player
2: Query type: AuthQueryString

Returns

1: IsAuthorizedOrNot? type: boolean

Same functionality as IsAuthorized(...2) however accepts a singular query instead of a group of queries. Faster compile speed & much less expensive, but it's recommended you only use this if you are only checking a small amount of individual queries.

`IsAuthorized#Async(...2)`

Parameters

1: Player type: Player
2: AuthQuery type: AuthQuery<AuthQueryString>

Returns

1: AuthPromise type: Promise

Same functionality as IsAuthorized(...2) however returns a promise instead of a pure-lua boolean.

IsAuthorized:Async(...):andThen(function()
print("User has permissions!")
end):catch(function()
print("No permissions!")
end)

Functions

Now that we have covered the core API, using IsAuthorized is simple.

`All: AuthQueryString`

The "All" keyword allows for any user to have permissions, regardless of any other factors.

{ "All", ~~"Everything else wont matter"~~ }

Cannot be negated

"All" cannot be negated using a negation character- if you want the opposite of all, use the following code.

{} -- an empty table is the idea of no one / no access.

`Group: AuthQueryString`

The "Group" function allows us to query the user's rank in a group and evaluate permissions from there.

Evaluating if a user is in a group

The following example evaluates if a user is in the group provided.

{ "Group:AnyGroup" }

{ "Group:AnyGroup:*" } -- using '*' has the same functionality as the above code.

Specifying a specific rank

The following example evaluates if a user is the specific rank.

{ "Group:AnyGroup:5" } -- looking for rank id 5.

Evaluating a range of ranks

The following example evaluates if a user is within the given range of ranks.

{ "Group:AnyGroup:3-55" } -- looking for any rank between and including 3 to 55.

The following example evaluates if a user is above or equal to the given rank.

{ "Group:AnyGroup:7+" } -- any rank >=7.

The following example evaluates if a user is less or equal to the given rank.

{ "Group:AnyGroup:7<" } -- any rank <=7.

`Team: AuthQueryString`

Team allows for a specific team to be specified for evaluation, Team is based on the physical and current team on the Player.

{ "Team:Prisoner" } -- anyone who is on the prisoner team.

`IsClient: AuthQueryString`

If the code is being ran on the client.

{ "IsClient" } -- if the evaluation is being ran on the client.

`IsServer: AuthQueryString`

If the code is being ran on the server.

{ "IsServer" } -- if the evaluation is being ran on the server.

Complex expressions & special characters

IsAuthorized allows for complex validation that is dynamic and expressive based on your inputs.

`RequireAll: AuthCommandQuery`

The evaluation will only be true if the user meets all the requirements.

{ "Group:Main:7+", "Team:Prisoner", RequireAll = true } -- the user will have to be both >=7 in the 'Main' group, and in the Prisoner team

`!: AuthCommandQuery`

The evaluation will be negated (NOT QUERY, !QUERY, true = false, false = true), also known as inversing the operation.

{ "!Group:Main:7" } -- everyone in the group EXCEPT those of rank 7

`Complex Expressions`

Feeling familiar with IsAuthorized, lets look at some complex expressions to ensure you get the full use of IsAuthorized.

The following expression requires the user to be a member of the Police Department team, but also they have the option of being in either the SWAT group at any role, or role 9+ in the Police group; however they are required to be in one of them alongside being in the Police Department team.

{
    {
        "Group:SWAT:*",
        "Group:Police:9+",
    },
    "Team:Police Department",
    RequireAll = true
}

Creating your own functions

IsAuthorization allows you to simply add new functions which you can immediately use.

Step 1: Locate the "Groups" folder within the IsAuthorized source file. (If you are using Wally, this will be in the Packages>_Index folder.)
Step 2: Create a ModuleScript; name this module script the name of your function.

Utilize the following format to create your own function, with the comments as guidance:

return {
Realm: string: "Shared" | "Server" | "Client" -- allows you to limit if only the client or server can use this function, shared means both can use it.
Function: (Player: Player, Groups: {[string]: number}, Arguments: string, RequestPacket: {[string]: boolean}) -> boolean: true | false
}

Explaining the Function

Parameters

1: Player type: Player= The player who is being evaluated.
2: Groups type: table= Provides a list of all the groups in the Groups.auth.lua (exact replica).
3: Arguments type: string= Provides the string query, for example "Group:Test:*" which you can then string.split(":") to get each argument.
4: RequestPacket type: RequestPacket= Provides information regarding the request.

Types

`AuthQuery<T>`

The full query provided to an IsAuthorized evaluation. Also known as a "Segment"
{ querystring, querystring }

`AuthQueryString`

An individual string query within an AuthQuery.

`AuthCommandQuery`

Something that is included within the AuthQuery but is not an authorization tool- rather acts to influence the behavior of the AuthQuery.
For example RequireAll is not a permission tool, rather influences that all queries must be true.

`RequestPacket`

Packet of information regarding the sent authorization query. Also known as "StandardRequestPacket"

{
IsNegated: boolean: true | false
}