AnyActionPermissionCheck
AnyActionPermissionCheck<
TData,TUser,TOrg> =BasePermissionCheck<TData,TUser,TOrg> |ConstrainedPermissionCheck<TData,TUser,TOrg,AccessPredicateBuilder<TData>>
Defined in: packages/core/src/access/types.ts:240
Every check shape valid on any action, query-shaped or not: the plain leaf shapes plus the constraint-builder object form (DD 14).
This is the tier RolePermissions hands a non-query action. The only difference
from PermissionCheck is q’s type: a query action’s q has withIndex,
this one’s does not.
Why ConstrainedPermissionCheck sits here rather than inside
BasePermissionCheck. Both are now valid on every action, so folding
them looks tempting. It cannot be done: BasePermissionCheck is also the type of
the filter property inside both object forms, so folding the composite into
it makes filter able to hold another whole constrained check —
{ constraints, filter: { constraints, filter: … } } — an infinite regress the
compiler accepts and hasPermission’s resolver has no meaning for. filter is
the per-document escape hatch for what constraints cannot express; a constraints
object is not a leaf check. “Base” stays the irreducible shapes — a value or a
function — and the composites point at it, never the other way round.
Type Parameters
Section titled “Type Parameters”TData = unknown
Document type for the subject.
TUser = Record<string, unknown>
User document shape.
TOrg = Record<string, unknown>
Organization document shape; never if not configured.