Mathematical Set Operations with Native JavaScript Set Methods

For years, JavaScript developers working with distinct collections had to rely on cumbersome array gymnastics to compute basic mathematical set relations. Constructing an intersection or difference required spreading sets into transient arrays, executing higher-order filter callbacks such as [...setA].filter(item => setB.has(item)), and subsequently re-instantiating a new Set instance. This pattern not only clutters application code with boilerplate but also incurs substantial performance penalties through intermediate object allocations, array indexing, and avoidable garbage collection overhead.

The ECMAScript Set Methods specification directly remedies these inefficiencies by equipping Set.prototype with a comprehensive suite of native algebraic operations. Standardizing methods like union(), intersection(), difference(), symmetricDifference(), isSubsetOf(), isSupersetOf(), and isDisjointFrom(), the runtime executes set logic at engine level. By accepting any set-like structure and internally optimizing iterations—such as traversing the smaller collection during intersection checks—native set methods streamline high-frequency data comparisons while maintaining predictable memory characteristics.

Example #

// Native ECMAScript Set methods for mathematical set operations
const engineeringRoles = new Set(['developer', 'designer', 'qa']);
const managementRoles = new Set(['manager', 'director', 'qa']);

// Compute union of all distinct roles
const allRoles = engineeringRoles.union(managementRoles);
console.log([...allRoles]); // ['developer', 'designer', 'qa', 'manager', 'director']

// Find shared roles using intersection
const sharedRoles = engineeringRoles.intersection(managementRoles);
console.log([...sharedRoles]); // ['qa']

// Determine roles exclusive to engineering
const engineeringOnly = engineeringRoles.difference(managementRoles);
console.log([...engineeringOnly]); // ['developer', 'designer']

// Check if management is completely separate from external contractors
const contractors = new Set(['contractor_dev', 'auditor']);
console.log(managementRoles.isDisjointFrom(contractors)); // true

Implementation #

/**
 * Real-world Role-Based Access Control (RBAC) authorizer
 * leveraging native ECMAScript Set methods for permission evaluation.
 */

// Define application permission catalogs
const ROLE_PERMISSIONS = {
  admin: new Set([
    'users:read',
    'users:write',
    'users:delete',
    'billing:read',
    'billing:write',
    'reports:export'
  ]),
  editor: new Set([
    'posts:read',
    'posts:write',
    'posts:publish',
    'media:upload'
  ]),
  billing_manager: new Set([
    'billing:read',
    'billing:write',
    'reports:export'
  ]),
  viewer: new Set([
    'posts:read',
    'users:read'
  ])
};

// Restricted roles that cannot co-exist due to compliance separation of duties
const AUDITOR_ROLES = new Set(['auditor', 'compliance_officer']);
const WRITE_ROLES = new Set(['admin', 'editor', 'billing_manager']);

export class AccessController {
  /**
   * Aggregate effective permissions across multiple user roles using set union.
   * Avoids manual loop concatenation and eliminates duplicate permission tokens.
   *
   * @param {string[]} assignedRoles - Array of role identifier strings.
   * @returns {Set<string>} Consolidated set of unique permissions.
   */
  static getEffectivePermissions(assignedRoles) {
    let effective = new Set();

    for (const role of assignedRoles) {
      const perms = ROLE_PERMISSIONS[role];
      if (perms) {
        effective = effective.union(perms);
      }
    }

    return effective;
  }

  /**
   * Validates whether a user satisfies all required permissions for an action.
   * Employs isSubsetOf to check containment without array flattening.
   *
   * @param {Set<string>} userPermissions - Active permissions granted to the user.
   * @param {Set<string>} requiredPermissions - Permissions mandatory for the endpoint.
   * @returns {boolean} True if all required permissions are satisfied.
   */
  static hasRequiredPermissions(userPermissions, requiredPermissions) {
    // True if every item in requiredPermissions exists within userPermissions
    return requiredPermissions.isSubsetOf(userPermissions);
  }

  /**
   * Identifies missing permissions required to access a protected resource.
   *
   * @param {Set<string>} userPermissions - Active permissions granted to the user.
   * @param {Set<string>} requiredPermissions - Required permissions.
   * @returns {Set<string>} Missing permission tokens.
   */
  static getMissingPermissions(userPermissions, requiredPermissions) {
    return requiredPermissions.difference(userPermissions);
  }

  /**
   * Checks separation-of-duties compliance using isDisjointFrom.
   * Ensures an auditor role cannot be paired with write or administrative roles.
   *
   * @param {string[]} assignedRoles - Roles assigned to the subject.
   * @returns {Object} Result object with compliant flag and conflicting roles.
   */
  static verifyComplianceSeparation(assignedRoles) {
    const userRoleSet = new Set(assignedRoles);
    const hasAuditorRole = !userRoleSet.isDisjointFrom(AUDITOR_ROLES);
    const hasWriteRole = !userRoleSet.isDisjointFrom(WRITE_ROLES);

    if (hasAuditorRole && hasWriteRole) {
      const conflicting = userRoleSet.intersection(WRITE_ROLES);
      return {
        compliant: false,
        conflictingRoles: conflicting
      };
    }

    return {
      compliant: true,
      conflictingRoles: new Set()
    };
  }
}

// Example usage and verification
const currentUserRoles = ['editor', 'viewer'];
const userPerms = AccessController.getEffectivePermissions(currentUserRoles);

const publishActionReqs = new Set(['posts:read', 'posts:publish']);
const canPublish = AccessController.hasRequiredPermissions(userPerms, publishActionReqs);
console.log('Can publish post:', canPublish); // true

const adminActionReqs = new Set(['users:delete', 'billing:write']);
const missing = AccessController.getMissingPermissions(userPerms, adminActionReqs);
console.log('Missing permissions:', [...missing]); // ['users:delete', 'billing:write']

const compliance = AccessController.verifyComplianceSeparation(['auditor', 'editor']);
console.log('Compliance status:', compliance.compliant); // false
console.log('Conflicts:', [...compliance.conflictingRoles]); // ['editor']

Main Point: Standard ECMAScript Set methods deliver expressive mathematical collection operations directly in the JavaScript runtime while eliminating the allocation overhead of temporary array conversions.

Credits #

Photo by Simone Hutsch on Unsplash

← Home