live-reloadtutorial

Tutorial: hand-editing a role file, live

Chintan Goswami·Jul 18, 2026·2 min read

This is a small, runnable demo you can do yourself in about two minutes — no admin UI, no API calls, just editing a file.

Set up a role and confirm the baseline

import { RBAC } from 'rbac-fs';

const rbac = new RBAC(); // .rbac/_shared/
await rbac.createRole('manager', { permissions: [{ resource: 'invoice', actions: ['approve'] }] }, { force: true });

const user = { id: 'u1', role: 'manager' };
console.log('before edit:', await rbac.can(user, 'invoice', 'delete')); // false

Run this — it'll print false, since manager only has approve, not delete.

Open the file it just created

.rbac/_shared/roles/manager.json

{
  "name": "manager",
  "permissions": [
    { "resource": "invoice", "actions": ["approve"] }
  ]
}

Add "delete" to the actions array by hand, in your editor, and save:

{
  "name": "manager",
  "permissions": [
    { "resource": "invoice", "actions": ["approve", "delete"] }
  ]
}

Check again, without restarting anything

// still the same running process, same rbac instance
console.log('after edit:', await rbac.can(user, 'invoice', 'delete')); // true

If your script already exited, put both can() calls plus a short pause in one file, edit the JSON in another window during the pause, then let the script continue — that's the realistic version of what live-reload is actually for: an app that's already running, whose permissions get corrected by hand while it keeps serving traffic.

Why this matters beyond a demo

This is the same mechanism a non-engineer teammate would use to fix a permission mistake in production without needing anyone to write code or deploy anything — open the file, make the edit, save it, done. It's also exactly why role files being plain, readable JSON (not a binary format or an encrypted blob) is a real requirement, not a nice-to-have: a human has to be able to make this edit correctly by hand.

Verified against examples/06-live-reload-watcher.mjs.