VexAccessConfig
Defined in: packages/core/src/access/types.ts:870
Resolved access configuration returned by defineAccess — the runtime
shape consumed by hasPermission.
Deliberately VALUE-LEVEL TYPE-ERASED: every call-site guarantee
(resource/action unions, callback data types, field keys) rides the
phantom TSubjects parameter, while the stored fields are wide. This is
what lets any concrete config assign to plain VexAccessConfig (e.g. the
access field on VexConfig) — a fully-generic config type would be
unassignable to any common supertype, because permission callbacks are
contravariant in their data parameter.
Type Parameters
Section titled “Type Parameters”TSubjects
Section titled “TSubjects”TSubjects extends Record<string, SubjectEntry> = Record<string, SubjectEntry>
Phantom SubjectMap carried for hasPermission inference.
TResources
Section titled “TResources”TResources extends readonly AccessResource[] = readonly AccessResource[]
TUserSlug
Section titled “TUserSlug”TUserSlug extends CollectionSlug = CollectionSlug
TOrgSlug
Section titled “TOrgSlug”TOrgSlug extends CollectionSlug | undefined = CollectionSlug | undefined
TCustomActions
Section titled “TCustomActions”TCustomActions extends Partial<Record<TResources[number]["slug"] | TUserSlug | Extract<TOrgSlug, string>, CustomActionsInput>> = Partial<Record<TResources[number]["slug"] | TUserSlug | Extract<TOrgSlug, string>, CustomActionsInput>>
Properties
Section titled “Properties”__subjects?
Section titled “__subjects?”
readonlyoptional__subjects?:TSubjects
Defined in: packages/core/src/access/types.ts:944
Phantom field carrying SubjectMap for inference. Optional and never assigned at runtime.
anonRole?
Section titled “anonRole?”
optionalanonRole?:string
Defined in: packages/core/src/access/types.ts:895
The allback role when there is no user.
customActions?
Section titled “customActions?”
optionalcustomActions?:TCustomActions
Defined in: packages/core/src/access/types.ts:909
Custom actions per subject slug, as declared in defineAccess. Carried on the
RESOLVED config purely so request-time code can tell a declared verb from a typo:
an undeclared action resolves through defaultPermissionMode (default allow),
so without this record a misspelled access.action silently widens access.
enabled
Section titled “enabled”enabled:
boolean
Defined in: packages/core/src/access/types.ts:890
Default: true. Turn access control on or off.
orgCollectionSlug?
Section titled “orgCollectionSlug?”
optionalorgCollectionSlug?:TOrgSlug
Defined in: packages/core/src/access/types.ts:931
Slug of the organization collection, when configured.
permissions
Section titled “permissions”permissions:
Record<string,Record<string,unknown>>
Defined in: packages/core/src/access/types.ts:938
The permission matrix as authored (checks may be booleans, field-mode
objects, or callbacks). Type-erased for storage; defineAccess fully
type-checks it at authoring time.
resources
Section titled “resources”resources:
TResources
Defined in: packages/core/src/access/types.ts:901
Collections/globals contributing subjects, keyed by slug.
roles: readonly
string[]
Defined in: packages/core/src/access/types.ts:898
Role names known to the system.
userCollectionSlug
Section titled “userCollectionSlug”userCollectionSlug:
TUserSlug
Defined in: packages/core/src/access/types.ts:925
Slug of the user collection.
userRolesField
Section titled “userRolesField”userRolesField:
string
Defined in: packages/core/src/access/types.ts:928
Field on the user document holding role(s) (string | string[]).