ConstrainedPermissionCheck
Defined in: packages/core/src/access/types.ts:205
The constraint-builder object form of a permission check — ONE shape for every action.
constraints narrows what gets read: compiled to a withIndex range when the
rule called q.withIndex(…), otherwise to a .filter() expression, and in
either case interpreted per-document as a JS predicate
(compileConstraints). filter is an OPTIONAL additional per-document check
for what constraints cannot express — array membership, string operations,
cross-table reads, all outside FilterBuilder’s surface, so they stay
callbacks permanently.
filter augments constraints; it never replaces it. A rule that declares
only constraints is already checked per-document too, via
constraintsToPredicate in hasPermission. A bare filter-only shape is
therefore rejected — a callback with no descriptor cannot narrow a query, so
write it as a bare callback instead and accept the full scan knowingly.
Index pushdown is opted into INSIDE the callback
(AccessQueryBuilder.withIndex), not by a sibling property. That is
what lets q bind to one index’s real field tuple and check field ORDER at
compile time; a sibling property cannot be seen by its neighbour’s callback
type.
Type Parameters
Section titled “Type Parameters”TData = unknown
Document type for the subject.
TUser = Record<string, unknown>
User document shape.
TOrg = Record<string, unknown>
Organization document shape; never if not configured.
TQ = AccessPredicateBuilder<TData>
The builder for this action.
Properties
Section titled “Properties”constraints
Section titled “constraints”constraints:
ConstraintsCallback<TData,TUser,TOrg,TQ>
Defined in: packages/core/src/access/types.ts:212
Narrows what gets read. Required — see the type doc.
filter?
Section titled “filter?”
optionalfilter?:BasePermissionCheck<TData,TUser,TOrg>
Defined in: packages/core/src/access/types.ts:214
Optional per-document check augmenting constraints. Never a substitute.