var access = require('context-access');
access.allow({
  url: '/public',
  role: 'guest'
});
access.assert({
  url: '/public'
});
// => false

access.allow({
  url: '/public',
  role: 'guest'
});
access.assert({
  url: '/public',
  role: 'guest'
});
// => true

["role1", "role1"]                role1 AND role2
[["role1", "role2"]]              role1 OR role2
["role1", ["role2", "role3"]]     role1 AND (role2 OR role3)
access.allow({
  url: '/private',
  roles: [['manager', 'admin']]
});
access.assert({
  roles: 'manager'
});
// => true

var app = require('express')();
var access = require('context-access');
// Allow users with manager or admin role to POST to /users
access.allow({
  path: '/users',
  method: [['GET', 'POST']]
  role: [['manager', 'admin']],
});
// Route middleware
var authorize = function(req, res, next) {
  var context = {
    role: req.session.role,   // admin
    path: req.path,           // /users
    method: req.method        // POST
  };
  if (access.assert(context)) {
    return next();
  }
  else {
    res.send(403, 'You must be an admin to do this!');
  }
};
// Use route middleware
app.post('/users', authorize, function(req, res) {
  // ...
});