AnyActionPermissionCheck
AnyActionPermissionCheck<
TData,TUser,TOrg> =BasePermissionCheck<TData,TUser,TOrg> |ConstrainedPermissionCheck<TData,TUser,TOrg>
Defined in: packages/core/src/access/types.ts:344
Every check shape valid on any action, query-shaped or not: the plain leaf shapes plus the narrowing object form.
This is the tier RolePermissions hands a non-query action. The only difference
from PermissionCheck is that withIndex is unusable here (typed as
WithIndexOnMutationError): a create/update/delete has no query to narrow,
so only where is available.
Why ConstrainedPermissionCheck sits here rather than inside
BasePermissionCheck. Both are now valid on every action, so folding
them looks tempting. It cannot be done: BasePermissionCheck is also the type of
the filter property inside both object forms, so folding the composite into
it makes filter able to hold another whole narrowing check —
{ where, filter: { where, filter: … } } — an infinite regress the
compiler accepts and hasPermission’s resolver has no meaning for. filter is
the per-document escape hatch for what withIndex/where cannot express; a
narrowing object is not a leaf check. “Base” stays the irreducible shapes — a
value or a function — and the composites point at it, never the other way round.
Type Parameters
Section titled “Type Parameters”TData = unknown
Document type for the subject.
TUser = Record<string, unknown>
User document shape.
TOrg = Record<string, unknown>
Organization document shape; never if not configured.