ResolveOptions
ResolveOptions =
object
Defined in: packages/schema/src/access/resolve.ts:19
How resolveAccess decides what the resource’s rules leave open.
Properties
Section titled “Properties”defaultAccess?
Section titled “defaultAccess?”
optionaldefaultAccess?:"allow"|"deny"
Defined in: packages/schema/src/access/resolve.ts:39
Overrides what an operation without a rule does. Without roles the default is allow,
the single-admin case; with roles it is the capability check above. Choosing allow
together with roles is an explicit opt-in, see accessWarnings.
roles?
Section titled “roles?”
optionalroles?:object
Defined in: packages/schema/src/access/resolve.ts:26
The project’s roles. When given, an operation without a rule is denied unless the user’s
roles grant <resource>.<action> (so admin’s * still passes). Fields without a rule
follow their resource, within the fields the roles list for the capability. With an anonymous role, a caller
holding only that role needs its capability even where a rule or defaultAccess would allow.
can: (
capability) =>Rule
The rule allowing a capability, as defineRoles makes it.
Parameters
Section titled “Parameters”capability
Section titled “capability”any
Returns
Section titled “Returns”definitions?
Section titled “definitions?”
optionaldefinitions?:Record<string,unknown>
The roles by name, to tell whether the project has an anonymous role.
fields?
Section titled “fields?”
optionalfields?: (user,capability) => readonlystring[] |undefined
The fields the user’s roles list for a capability, or undefined for every field.
Parameters
Section titled “Parameters”capability
Section titled “capability”string
Returns
Section titled “Returns”readonly string[] | undefined