javascript - How to deal with user permissions in single page application -

i'm working on single page enterprise application pretty complex logic user permissions. huge part of works entirely on client communicating backend server using ajax sending json , forth. tricky part need implement permission mechanism on per-entity basis, , dont know how right way.

to explain myself here example code, have 2 entity classes on backend user , node:

class user {     long id; } class node {     long id;     string name;     status status;     node parent;     list<user> admins; } enum status {     status_1, status_2 } 

i send json of parent node server:

{id: 1, name: "node name 1", status: 'status_1'} 

and recieve json bunch of child nodes:

[     {id: 11, name: "node name 1.1", status: 'status_1'},      {id: 12, name: "node name 1.2", status: 'status_1'} ] 

on client displayed in tree-like structure, this:

now tricky part:

1. simple user works application can see tree, can't change anything.

2. user can change node name if among admins of node or of parent nodes.

3. admins can change status of node, status_1 status_2, if child nodes has status_2 status.

4. there list of super adminstrators can whatever want: change properties of node, change status want.

so somehow, during rendering of tree on client, need know user can or cannot each of node on page. can't assign user role within whole application because user rights vary 1 node another. can't see whole picture on client side because child nodes may not loaded. how can manage user permissions in situation this? what's proper way or pattern use?

should attach role object each node, or maybe bunch of flags representing user can or cannot that:

{      id: 12,      name: "node name 1.2",      status: "status_1",      canchangename: true,     canchangestatus: false } 

that looks pretty silly me.

i solve complex (and not complex) permission-based tasks in application using acl classes.

i have simple, lighweight classes, take model, permissions being checked, , user object constructor. have bunch of methods names canxxxx(). these methods can optionally take parameters if needed.

if have same model classes on front , back, might able reuse acls in both cases.

can use approach?