Access

Defined in: src/core/Access.ts:25

Represents the inner Access class that helps build an access information to be granted or denied; and finally commits it to the underlying grants model. You can get a first instance of this class by calling AccessControl#grant() or AccessControl#deny() methods.

Accessors

denied

Get Signature

get denied(): boolean

Defined in: src/core/Access.ts:111

Specifies whether this access is initially denied.

Returns

boolean

Methods

role()

role(value): Access

Defined in: src/core/Access.ts:124

A chainer method that sets the role(s) for this Access instance.

Parameters

value

string | string[]

A single or array of roles.

Returns

Access

• Self instance of Access.

---

resource()

resource(value): Access

Defined in: src/core/Access.ts:138

A chainer method that sets the resource for this Access instance.

Parameters

value

string | string[]

Target resource for this Access instance.

Returns

Access

• Self instance of Access.

---

attributes()

attributes(value): Access

Defined in: src/core/Access.ts:152

Sets the attributes for the next action committed in this chain: the allowed ones on a grant, the denied ones on a deny. An attributes argument passed to the action method itself takes precedence.

Parameters

value

string | string[]

Attributes to be set.

Returns

Access

• Self instance of Access.

---

where()

where(condition): Access

Defined in: src/core/Access.ts:171

Attaches a declarative condition to this grant — whether the grant applies at check time. Accepts the string-sugar form ('$.order.value > 100000') or canonical JSON ({ and|or|not } / [lhs, op, rhs]); it is compiled and validated when committed. Pairs with the attribute list (['*','!password']), which decides what fields return.

Parameters

condition

ConditionJSON

The condition (string sugar or canonical JSON).

Returns

Access

• Self instance of Access.

Example

ac.grant('manager')
  .where('$.order.value > 100000')
  .updateAny('order', ['*']);

---

during()

during(expression): Access

Defined in: src/core/Access.ts:198

Attaches a temporal schedule to this grant: it applies only while the check instant — the reserved $.now (i.e. context.now, defaulting to the current time) — is covered by the given dtrexp expression. Shorthand for AND-ing ['$.now', 'during', expression] into this grant’s condition; composes with .where() regardless of call order. The timezone comes from the reserved context.tz (IANA name; defaults to the system zone). The expression is validated when the chain commits (on the action call): malformed or never-matching expressions throw.

Repeated calls AND together (all schedules must cover the instant); to express alternatives, use a union (|) inside a single expression.

Parameters

expression

string

A dtrexp date-time range / recurrence expression.

Returns

Access

• Self instance of Access.

Example

ac.grant('trader')
  .where('$.order.value <= 100000')
  .during('T0900:1800 E1:5') // Mon–Fri, 09:00–18:00
  .updateAny('order', ['*']);

---

extend()

extend(roles): Access

Defined in: src/core/Access.ts:215

Sets the roles to be extended (inherited) for this Access instance.

Parameters

roles

string | string[]

A single or array of roles.

Returns

Access

• Self instance of Access.

Example

ac.grant('user').createAny('video')
  .grant('admin').extend('user');
const permission = ac.can('admin').createAny('video');
console.log(permission.granted); // true

---

grant()

grant(roleOrInfo?): Access

Defined in: src/core/Access.ts:230

Shorthand to switch to a new Access instance with a different role within the method chain.

Parameters

roleOrInfo?

string | string[] | IAccessInfo

Either a single or an array of roles or an

Returns

Access

• A new Access instance.

Example

ac.grant('user').createOwn('video')
  .grant('admin').updateAny('video');

---

deny()

deny(roleOrInfo?): Access

Defined in: src/core/Access.ts:243

Shorthand to switch to a new Access instance with a different (or same) role within the method chain.

Parameters

roleOrInfo?

string | string[] | IAccessInfo

Either a single or an array of roles or an

Returns

Access

• A new Access instance.

Example

ac.grant('admin').createAny('video')
  .deny('user').deleteAny('video');

---

lock()

lock(): Access

Defined in: src/core/Access.ts:250

Chainable, convenience shortcut for AccessControl#lock().

Returns

Access

---

action()

action(actionSpec, resource?, attributes?): Access

Defined in: src/core/Access.ts:270

Generic authoring entry for any action — CRUD or custom. The CRUD methods (createAny, updateOwn, …) are named sugar over this same commit path. actionSpec may carry possession via the :own/:any convention (omit ⇒ any).

Parameters

actionSpec

string

Action name, optionally name:own/name:any.

resource?

string | string[]

Target resource(s).

attributes?

string | string[]

Granted (or denied) attributes; omitted, the list set with .attributes(), else ['*'].

Returns

Access

• Self instance of Access.

Example

ac.grant('editor').action('publish', 'article', ['*']);      // publish:any
ac.grant('author').action('publish:own', 'article', ['*']);  // ownership-gated

---

do()

do(actionSpec, resource?, attributes?): Access

Defined in: src/core/Access.ts:284

The single sanctioned alias of Access#action — the one intentional exception to the v3 alias purge. Generic: CRUD and custom.

Parameters

actionSpec

string

Action name, optionally name:own/name:any.

resource?

string | string[]

Target resource(s).

attributes?

string | string[]

Granted attributes.

Returns

Access

• Self instance of Access.

---

createOwn()

createOwn(resource?, attributes?): Access

Defined in: src/core/Access.ts:307

Sets the action to "create" and possession to "own" and commits the current access instance to the underlying grant model.

Parameters

resource?

string | string[]

Defines the target resource this access is granted or denied for. This is only optional if the resource is previously defined. If not defined and omitted, this will throw.

attributes?

string | string[]

Defines the resource attributes for which the access is granted or denied. Omitted, it defaults to ["*"]: every attribute, granted or denied, unless a list was set with .attributes() in the chain. An explicit [] is kept: a grant of no attributes, or a deny of none.

Returns

Access

• Self instance of Access so that you can chain and define another access instance to be committed.

Throws

• If the access instance to be committed has any invalid data.

---

createAny()

createAny(resource?, attributes?): Access

Defined in: src/core/Access.ts:330

Sets the action to "create" and possession to "any" and commits the current access instance to the underlying grant model.

Parameters

resource?

string | string[]

Defines the target resource this access is granted or denied for. This is only optional if the resource is previously defined. If not defined and omitted, this will throw.

attributes?

string | string[]

Defines the resource attributes for which the access is granted or denied. Omitted, it defaults to ["*"]: every attribute, granted or denied, unless a list was set with .attributes() in the chain. An explicit [] is kept: a grant of no attributes, or a deny of none.

Returns

Access

• Self instance of Access so that you can chain and define another access instance to be committed.

Throws

• If the access instance to be committed has any invalid data.

---

readOwn()

readOwn(resource?, attributes?): Access

Defined in: src/core/Access.ts:360

Sets the action to "read" and possession to "own" and commits the current access instance to the underlying grant model.

Parameters

resource?

string | string[]

Defines the target resource this access is granted or denied for. This is only optional if the resource is previously defined. If not defined and omitted, this will throw.

attributes?

string | string[]

Defines the resource attributes for which the access is granted or denied. Omitted, it defaults to ["*"]: every attribute, granted or denied, unless a list was set with .attributes() in the chain. An explicit [] is kept: a grant of no attributes, or a deny of none.

Returns

Access

• Self instance of Access so that you can chain and define another access instance to be committed.

Throws

• If the access instance to be committed has any invalid data.

---

readAny()

readAny(resource?, attributes?): Access

Defined in: src/core/Access.ts:383

Sets the action to "read" and possession to "any" and commits the current access instance to the underlying grant model.

Parameters

resource?

string | string[]

Defines the target resource this access is granted or denied for. This is only optional if the resource is previously defined. If not defined and omitted, this will throw.

attributes?

string | string[]

Defines the resource attributes for which the access is granted or denied. Omitted, it defaults to ["*"]: every attribute, granted or denied, unless a list was set with .attributes() in the chain. An explicit [] is kept: a grant of no attributes, or a deny of none.

Returns

Access

• Self instance of Access so that you can chain and define another access instance to be committed.

Throws

• If the access instance to be committed has any invalid data.

---

updateOwn()

updateOwn(resource?, attributes?): Access

Defined in: src/core/Access.ts:413

Sets the action to "update" and possession to "own" and commits the current access instance to the underlying grant model.

Parameters

resource?

string | string[]

Defines the target resource this access is granted or denied for. This is only optional if the resource is previously defined. If not defined and omitted, this will throw.

attributes?

string | string[]

Defines the resource attributes for which the access is granted or denied. Omitted, it defaults to ["*"]: every attribute, granted or denied, unless a list was set with .attributes() in the chain. An explicit [] is kept: a grant of no attributes, or a deny of none.

Returns

Access

• Self instance of Access so that you can chain and define another access instance to be committed.

Throws

• If the access instance to be committed has any invalid data.

---

updateAny()

updateAny(resource?, attributes?): Access

Defined in: src/core/Access.ts:436

Sets the action to "update" and possession to "any" and commits the current access instance to the underlying grant model.

Parameters

resource?

string | string[]

Defines the target resource this access is granted or denied for. This is only optional if the resource is previously defined. If not defined and omitted, this will throw.

attributes?

string | string[]

Defines the resource attributes for which the access is granted or denied. Omitted, it defaults to ["*"]: every attribute, granted or denied, unless a list was set with .attributes() in the chain. An explicit [] is kept: a grant of no attributes, or a deny of none.

Returns

Access

• Self instance of Access so that you can chain and define another access instance to be committed.

Throws

• If the access instance to be committed has any invalid data.

---

deleteOwn()

deleteOwn(resource?, attributes?): Access

Defined in: src/core/Access.ts:466

Sets the action to "delete" and possession to "own" and commits the current access instance to the underlying grant model.

Parameters

resource?

string | string[]

Defines the target resource this access is granted or denied for. This is only optional if the resource is previously defined. If not defined and omitted, this will throw.

attributes?

string | string[]

Defines the resource attributes for which the access is granted or denied. Omitted, it defaults to ["*"]: every attribute, granted or denied, unless a list was set with .attributes() in the chain. An explicit [] is kept: a grant of no attributes, or a deny of none.

Returns

Access

• Self instance of Access so that you can chain and define another access instance to be committed.

Throws

• If the access instance to be committed has any invalid data.

---

deleteAny()

deleteAny(resource?, attributes?): Access

Defined in: src/core/Access.ts:489

Sets the action to "delete" and possession to "any" and commits the current access instance to the underlying grant model.

Parameters

resource?

string | string[]

Defines the target resource this access is granted or denied for. This is only optional if the resource is previously defined. If not defined and omitted, this will throw.

attributes?

string | string[]

Defines the resource attributes for which the access is granted or denied. Omitted, it defaults to ["*"]: every attribute, granted or denied, unless a list was set with .attributes() in the chain. An explicit [] is kept: a grant of no attributes, or a deny of none.

Returns

Access

• Self instance of Access so that you can chain and define another access instance to be committed.

Throws

• If the access instance to be committed has any invalid data.