VexAccessConfigInput

Defined in: packages/core/src/access/types.ts:754

Input shape for the defineAccess builder.

Type Param

TUserCollection

{ slug } shape naming the user collection.

Type Param

TOrgCollection

{ slug } shape naming the org collection; undefined if absent.

See

VexAccessConfig for the resolved runtime shape.

Type Parameters

TRoles

TRoles extends readonly string[]

Tuple of role name literals.

TResources

TResources extends readonly AccessResource[] = readonly AccessResource[]

Structural resource tuple ({ slug, versions? }).

TCustomResources

TCustomResources extends Record<string, CustomResourceInput> = { }

Custom resource declarations.

TUserSlug

TUserSlug extends CollectionSlug = CollectionSlug

TOrgSlug

TOrgSlug extends CollectionSlug | undefined = undefined

TCustomActions

TCustomActions extends Partial<Record<TResources[number]["slug"] | TUserSlug | Extract<TOrgSlug, string>, CustomActionsInput>> = { }

Properties

anonRole?

optional anonRole?: TRoles[number]

Defined in: packages/core/src/access/types.ts:773

OPTIONAL. Role applied when a caller’s roles resolve empty — no session, or an anonymous user (e.g. Better Auth anonymous plugin) whose userRolesField is unset. Explicit roles always win over this fallback. Omitted → empty roles deny, exactly as before.

---

customActions?

optional customActions?: TCustomActions & Partial<Record<TUserSlug | TResources[number]["slug"] | Extract<TOrgSlug, string>, CustomActionsInput>> & { [K in string | number | symbol]: never }

Defined in: packages/core/src/access/types.ts:802

Extra actions per resource, beyond CRUD. Keys must be declared resource slugs (or the user/org collection slugs).

Three constituents, each load-bearing:

1. TCustomActions — the inference site; carries the caller’s literal declaration into the phantom SubjectMap.
2. Partial<Record<slugs, …>> — the COMPLETION source. Key completions come from the property’s contextual type, and a bare unresolved type parameter offers nothing; this constituent names the slug union directly, which is resolvable in the first inference round (resources and the slugs are not context-sensitive). Redundant for checking — the bound already constrains values.
3. The exactness map — the TYPO guard. The Partial<Record<…>> bound cannot reject a bad key on its own: an all-optional target is a “weak type”, so TypeScript errors only when the object shares ZERO keys with it — one valid entry beside a garbage key passes, because structural subtyping permits extra properties and per-key excess checking does not fire against a generic-constrained inference. Mapping every key NOT in the slug union to never makes the garbage entry’s value unassignable AT ITS OWN KEY, restoring both the error and its location.

---

customResources?

optional customResources?: TCustomResources

Defined in: packages/core/src/access/types.ts:816

Custom, non-resource subjects with arbitrary action unions and optional typed data. Example: { apiKeys: { actions: ["create", "revoke"] } }.

---

enabled?

optional enabled?: boolean

Defined in: packages/core/src/access/types.ts:765

Default: true. Turn access control on or off.

---

orgCollectionSlug?

optional orgCollectionSlug?: TOrgSlug

Defined in: packages/core/src/access/types.ts:838

Slug of the organization collection. When present, organization is available (typed via the registry) in every permission callback; when omitted, callbacks have no organization key.

---

permissions

permissions: Record<TRoles[number], RolePermissions<SubjectMap<TResources, TCustomResources, TUserSlug, TOrgSlug, TCustomActions>, InferDocTypeFromSlug<TUserSlug>, TOrgSlug extends string ? InferDocTypeFromSlug<TOrgSlug> : never, TUserSlug, TOrgSlug>>

Defined in: packages/core/src/access/types.ts:844

Permission matrix: role → subject → check. See RolePermissions for shapes and wildcard semantics.

---

resources

resources: TResources

Defined in: packages/core/src/access/types.ts:779

Collections/globals contributing subjects, keyed by slug.

---

roles

roles: TRoles

Defined in: packages/core/src/access/types.ts:776

Role identifiers; keys of the permissions matrix.

---

userCollectionSlug

userCollectionSlug: TUserSlug

Defined in: packages/core/src/access/types.ts:824

Slug of the collection whose documents are user in callbacks. A plain slug string — the full collection often does not exist at authoring time (auth-adapter collections merge later, inside defineConfig); the document type resolves from the generated registry by slug.

---

userRolesField

userRolesField: string

Defined in: packages/core/src/access/types.ts:831

REQUIRED. The field on the user document that holds the user’s role(s). Value may be string or string[]; hasPermission normalizes both. Callers never pass roles separately — they always ride the user document.