PermissionCheck
PermissionCheck<
TData,TUser,TOrg,TIndexFields> =BasePermissionCheck<TData,TUser,TOrg> |ConstrainedPermissionCheck<TData,TUser,TOrg,AccessQueryBuilder<TData,TIndexFields>>
Defined in: packages/core/src/access/types.ts:267
A single permission check on a query-shaped action: the plain leaf shapes,
and the constraint form with q upgraded to an AccessQueryBuilder so
q.withIndex(…) is available.
The ONLY difference from AnyActionPermissionCheck is q’s type. Index
pushdown is gated by giving a query action a builder
that HAS withIndex and a mutation one that does not — so writing
q.withIndex(…) on a create is a missing-method error at the exact call, rather
than a whole-object shape rejection pointing at the wrong line (DD 14).
A callback returning undefined is treated as deny.
Type Parameters
Section titled “Type Parameters”TData = unknown
Document type for the subject.
TUser = Record<string, unknown>
User document shape.
TOrg = Record<string, unknown>
Organization document shape; never if not configured.
TIndexFields
Section titled “TIndexFields”TIndexFields extends Record<string, readonly string[]> = Record<string, readonly string[]>
The resource’s index name → field tuple map, which
q.withIndex resolves against.