VexAccessConfig
Defined in: packages/core/src/access/types.ts:1068
Resolved access configuration returned by defineAccess — the runtime
shape consumed by hasPermission.
Deliberately VALUE-LEVEL TYPE-ERASED: every call-site guarantee
(resource/action unions, callback data types, field keys) rides the
phantom TSubjects parameter, while the stored fields are wide. This is
what lets any concrete config assign to plain VexAccessConfig (e.g. the
access field on VexConfig) — a fully-generic config type would be
unassignable to any common supertype, because permission callbacks are
contravariant in their data parameter.
Type Parameters
Section titled “Type Parameters”TSubjects
Section titled “TSubjects”TSubjects extends Record<string, SubjectEntry> = Record<string, SubjectEntry>
Phantom SubjectMap carried for hasPermission inference.
TResources
Section titled “TResources”TResources extends readonly AccessResource[] = readonly AccessResource[]
TUserSlug
Section titled “TUserSlug”TUserSlug extends CollectionSlug = CollectionSlug
TOrgSlug
Section titled “TOrgSlug”TOrgSlug extends CollectionSlug | undefined = CollectionSlug | undefined
TCustomActions
Section titled “TCustomActions”TCustomActions extends Partial<Record<TResources[number]["slug"] | TUserSlug | Extract<TOrgSlug, string>, CustomActionsInput>> = Partial<Record<TResources[number]["slug"] | TUserSlug | Extract<TOrgSlug, string>, CustomActionsInput>>
Properties
Section titled “Properties”__subjects?
Section titled “__subjects?”
readonlyoptional__subjects?:TSubjects
Defined in: packages/core/src/access/types.ts:1145
Phantom field carrying SubjectMap for inference. Optional and never assigned at runtime.
anonRole?
Section titled “anonRole?”
optionalanonRole?:string
Defined in: packages/core/src/access/types.ts:1093
The allback role when there is no user.
customActions?
Section titled “customActions?”
optionalcustomActions?:TCustomActions
Defined in: packages/core/src/access/types.ts:1107
Custom actions per subject slug, as declared in defineAccess. Carried on the
RESOLVED config purely so request-time code can tell a declared verb from a typo:
an undeclared action resolves through defaultPermissionMode (default allow),
so without this record a misspelled access.action silently widens access.
enabled
Section titled “enabled”enabled:
boolean
Defined in: packages/core/src/access/types.ts:1088
Default: true. Turn access control on or off.
organizations
Section titled “organizations”organizations:
boolean
Defined in: packages/core/src/access/types.ts:1132
Default: false. Whether organizations are an enforced tenancy boundary — see VexAccessConfigInput.organizations.
orgCollectionSlug?
Section titled “orgCollectionSlug?”
optionalorgCollectionSlug?:TOrgSlug
Defined in: packages/core/src/access/types.ts:1129
Slug of the organization collection, when configured.
permissions
Section titled “permissions”permissions:
Record<string,Record<string,unknown>>
Defined in: packages/core/src/access/types.ts:1139
The permission matrix as authored (checks may be booleans, field-mode
objects, or callbacks). Type-erased for storage; defineAccess fully
type-checks it at authoring time.
resources
Section titled “resources”resources:
TResources
Defined in: packages/core/src/access/types.ts:1099
Collections/globals contributing subjects, keyed by slug.
roles: readonly
string[]
Defined in: packages/core/src/access/types.ts:1096
Role names known to the system.
userCollectionSlug
Section titled “userCollectionSlug”userCollectionSlug:
TUserSlug
Defined in: packages/core/src/access/types.ts:1123
Slug of the user collection.
userRolesField
Section titled “userRolesField”userRolesField:
string
Defined in: packages/core/src/access/types.ts:1126
Field on the user document holding role(s) (string | string[]).