ConstrainedPermissionCheck
ConstrainedPermissionCheck<
TData,TUser,TOrg,TIndexFields> = [TIndexFields] extends [never] ?object: {where?:AccessWhere<TData,TUser,TOrg>;withIndex:AccessWithIndex<TData,TUser,TOrg,TIndexFields>; } | {where:AccessWhere<TData,TUser,TOrg>;withIndex?:AccessWithIndex<TData,TUser,TOrg,TIndexFields>; } &object
Defined in: packages/core/src/access/types.ts:300
The narrowing object form of a permission check. Its properties map 1:1
onto find’s arguments: withIndex is the Convex index pushdown (query
actions only), where the portable predicate (every action). At least one
is required. filter is the optional per-document JS check for what
neither can express (array membership, string operations, cross-table
reads); it augments, never replaces.
TIndexFields = never marks a non-query action: withIndex is then
never, so declaring it on a create/update/delete is a type error at the
property.
Type Declaration
Section titled “Type Declaration”filter?
Section titled “filter?”
optionalfilter?:BasePermissionCheck<TData,TUser,TOrg>
Optional per-document check augmenting withIndex / where. Never a substitute.
Type Parameters
Section titled “Type Parameters”TData = unknown
Document type for the subject.
TUser = Record<string, unknown>
User document shape.
TOrg = Record<string, unknown>
Organization document shape; never if not configured.
TIndexFields
Section titled “TIndexFields”TIndexFields extends Record<string, readonly string[]> = never
The resource’s index map on query actions; never on mutations.