application.js

var Ability, ability, as_array, is_array, is_array_contains_array;

if (!Array.prototype.unique) {
  Array.prototype.unique = function() {
    var key, output, value, _i, _ref, _results;
    output = {};
    for (key = _i = 0, _ref = this.length; 0 <= _ref ? _i < _ref : _i > _ref; key = 0 <= _ref ? ++_i : --_i) {
      output[this[key]] = this[key];
    }
    _results = [];
    for (key in output) {
      value = output[key];
      _results.push(value);
    }
    return _results;
  };
}

if (!Array.prototype.contains_array) {
  Array.prototype.contains_array = function(arr) {
    return this.every(function(val) {
      return arr.indexOf(val) >= 0;
    });
  };
}

is_array = Array.isArray || function(value) {
  return {}.toString.call(value) === '[object Array]';
};

as_array = function(items) {
  if (!is_array(items)) {
    items = [items];
  }
  return items;
};

is_array_contains_array = function(arr1, arr2) {
  return arr2.every(function(val) {
    return arr1.indexOf(val) >= 0;
  });
};

Ability = (function() {

  function Ability() {}

  Ability.prototype._permissions = {};

  Ability.prototype.can = function(resource, actions) {
    Array.prototype.push.apply(this.get_permissions(resource), as_array(actions));
    return this._permissions[resource].unique();
  };

  Ability.prototype.permit = function(resource, actions) {
    return is_array_contains_array(this.get_permissions(resource), as_array(actions));
  };

  Ability.prototype.get_permissions = function(resource) {
    if (!is_array(this._permissions[resource])) {
      this._permissions[resource] = [];
    }
    return this._permissions[resource];
  };

  Ability.prototype.get_resources = function() {
    return Object.keys(this._permissions);
  };

  return Ability;

})();

ability = new Ability;
ability.can('user', ['create', 'update']);
ability.can('user', 'destroy');
ability.can('post', 'destroy');

console.log(ability.get_permissions('user'));
console.log(ability.get_permissions('post'));
console.log(ability.get_resources());
console.log(ability.permit('user', 'destroy'));
console.log(ability.permit('user', ['destroy', 'update']));
console.log(ability.permit('user', ['destroy', 'update', 'view']));