Skip to content

PermissionCheck

PermissionCheck<TData, TUser, TOrg, TIndexFields> = BasePermissionCheck<TData, TUser, TOrg> | ConstrainedPermissionCheck<TData, TUser, TOrg, AccessQueryBuilder<TData, TIndexFields>>

Defined in: packages/core/src/access/types.ts:267

A single permission check on a query-shaped action: the plain leaf shapes, and the constraint form with q upgraded to an AccessQueryBuilder so q.withIndex(…) is available.

The ONLY difference from AnyActionPermissionCheck is q’s type. Index pushdown is gated by giving a query action a builder that HAS withIndex and a mutation one that does not — so writing q.withIndex(…) on a create is a missing-method error at the exact call, rather than a whole-object shape rejection pointing at the wrong line (DD 14).

A callback returning undefined is treated as deny.

TData = unknown

Document type for the subject.

TUser = Record<string, unknown>

User document shape.

TOrg = Record<string, unknown>

Organization document shape; never if not configured.

TIndexFields extends Record<string, readonly string[]> = Record<string, readonly string[]>

The resource’s index name → field tuple map, which q.withIndex resolves against.