Setu-TS
    Preparing search index...

    Interface PolicyDefinition<A, T>

    A named authorization policy: a set of abilities over one target type, plus an optional before hook that may allow or deny every ability of the policy (an administrator bypass, a suspended-account block).

    The bare PolicyDefinition — A = string, T = never — is the type-erased form a registry stores. Two typing choices make every typed policy assignable to it under strictFunctionTypes: before is a METHOD signature, which TypeScript checks bivariantly, and the target defaults to never, so a check written for Post is assignable to a check over never.

    const postPolicy: PolicyDefinition<'update' | 'read', Post> = {
      name: 'post',
      abilities: {
        update: (principal, post) => post?.authorId === principal.id,
        read: { anonymous: true, check: (_principal, post) => post?.published === true },
      },
      before(principal) {
        return principal.roles?.includes('admin') === true ? true : undefined;
      },
    };

    0.9.0

    interface PolicyDefinition<A extends string = string, T = never> {
        abilities: Readonly<Record<A, PolicyAbility<T>>>;
        name: string;
        before?(
            principal: IPrincipal,
            ability: A,
            target: T | undefined,
        ): boolean | Promise<boolean | undefined> | undefined;
    }

    Type Parameters

    • A extends string = string

      The ability names

    • T = never

      The target type the abilities receive

    Index
    abilities name
    before?
    abilities: Readonly<Record<A, PolicyAbility<T>>>

    The abilities, keyed by ability name. before is not a legal ability name.

    name: string

    The policy's name — lowercase kebab-case (^[a-z][a-z0-9-]*$), unique within one application. It is the policy's identity: every entry point looks a policy up by this name.

    • Runs before the ability's check, for a signed-in principal only.

      Return true to allow, undefined to fall through to the ability's check, anything else — false, null, a non-boolean — to deny. A throw or rejection denies.

      Parameters

      • principal: IPrincipal

        The signed-in principal

      • ability: A

        The ability being evaluated

      • target: T | undefined

        The target, when one was supplied

      Returns boolean | Promise<boolean | undefined> | undefined

      true, undefined, or a deny

    Settings
    Member Visibility

    On This Page
    Properties
    Methods