HasPermissionProps
Defined in: packages/core/src/access/hasPermission.ts:65
Props required for the hasPermission({…}) function
access
The resolved config from defineAccess(). undefined
disables access control entirely — every check passes.
user
The authenticated user document. Roles are derived from
user[access.userRolesField] (string or string[]); a missing or empty
value falls back to access.anonRole
organization
The organization document forwarded to callbacks.
Only surfaces when access.orgCollectionSlug is configured.
resource
Subject name — a resource slug, a built-in subject
(e.g. "adminPanel"), or a custom resource name.
action
Action on resource, typed per subject.
data
Document/context forwarded to permission callbacks.
throwOnDenied
When true, throws VexAccessError instead of
scope
Which question to answer when a role’s check is a callback that
needs the document and data was not supplied:
"all" (default) asks “may they do this to every document” and resolves such
a check to false — fail-closed, never throws; "any" asks “may they do this
to at least one document” and resolves it to true (nav/sidebar/list gating —
row-level filtering happens separately in find/get); "doc" demands an
exact per-document answer and throws VexAccessError when data is missing,
which is what you want in edit views. Has no effect on static boolean checks,
and no effect when data is provided (the callback is always run against it).
Default
Section titled “Default”"all"changes
The keys this operation writes - the incoming payload on a create, the patch on an update. Supplied by write call sites only.
Distinct from data, which stays the STORED document so a per-document
rule cannot be satisfied by whatever the caller chose to send. When a
role’s check resolves to a FieldPermissionMap, every key here whose
value differs from data must be permitted by that map, or access is
denied naming the field.
Ignored entirely when no field map resolves, so omitting it never changes an existing call’s answer.
Type Parameters
Section titled “Type Parameters”TSubjects
Section titled “TSubjects”TSubjects extends Record<string, SubjectEntry> = Record<string, SubjectEntry>
TSubject
Section titled “TSubject”TSubject extends keyof TSubjects & string = keyof TSubjects & string
TData extends object = { }
Properties
Section titled “Properties”access?
Section titled “access?”
optionalaccess?:VexAccessConfig<TSubjects, readonlyAccessResource[],string,string|undefined,Partial<Record<string,CustomActionsInput>>>
Defined in: packages/core/src/access/hasPermission.ts:70
action
Section titled “action”action:
TSubjects[TSubject]["action"]
Defined in: packages/core/src/access/hasPermission.ts:74
changes?
Section titled “changes?”
optionalchanges?:NoInfer<Partial<TData>>
Defined in: packages/core/src/access/hasPermission.ts:78
optionaldata?:TData
Defined in: packages/core/src/access/hasPermission.ts:75
organization?
Section titled “organization?”
optionalorganization?:Record<string,unknown>
Defined in: packages/core/src/access/hasPermission.ts:72
resource
Section titled “resource”resource:
TSubject
Defined in: packages/core/src/access/hasPermission.ts:73
scope?
Section titled “scope?”
optionalscope?:PermissionScope
Defined in: packages/core/src/access/hasPermission.ts:77
throwOnDenied?
Section titled “throwOnDenied?”
optionalthrowOnDenied?:boolean
Defined in: packages/core/src/access/hasPermission.ts:76
user:
Record<string,unknown> |null
Defined in: packages/core/src/access/hasPermission.ts:71