Skip to content

permission.mdx

Latest commit

 

History

History
101 lines (68 loc) · 3.54 KB

permission.mdx

File metadata and controls

101 lines (68 loc) · 3.54 KB
Raw
title Permission
description Permission protocol schemas

{/* ⚠️ AUTO-GENERATED — DO NOT EDIT. Run build-docs.ts to regenerate. Hand-written docs go in content/docs/guides/. */}

Entity (Object) Level Permissions

Defines CRUD + VAMA (View All / Modify All) + Lifecycle access.

Refined with enterprise data lifecycle controls:

  • Transfer (Ownership change)

  • Restore (Soft delete recovery)

  • Purge (Hard delete / Compliance)

**Source:** `packages/spec/src/security/permission.zod.ts`

TypeScript Usage

import { FieldPermission, ObjectAccessScope, ObjectPermission, PermissionSet } from '@objectstack/spec/security';
import type { FieldPermission, ObjectAccessScope, ObjectPermission, PermissionSet } from '@objectstack/spec/security';

// Validate data
const result = FieldPermission.parse(data);

FieldPermission

Properties

Property Type Required Description
readable boolean ✅ Field read access
editable boolean ✅ Field edit access

ObjectAccessScope

Allowed Values

  • own
  • own_and_reports
  • unit
  • unit_and_below
  • org

ObjectPermission

Properties

Property Type Required Description
allowCreate boolean ✅ Create permission
allowRead boolean ✅ Read permission
allowEdit boolean ✅ Edit permission
allowDelete boolean ✅ Delete permission
allowTransfer boolean ✅ [EXPERIMENTAL — not enforced] Change record ownership
allowRestore boolean ✅ [EXPERIMENTAL — not enforced] Restore from trash (Undelete)
allowPurge boolean ✅ [EXPERIMENTAL — not enforced] Permanently delete (Hard Delete/GDPR)
viewAllRecords boolean ✅ View All Data (Bypass Sharing)
modifyAllRecords boolean ✅ Modify All Data (Bypass Sharing)
readScope Enum<'own' | 'own_and_reports' | 'unit' | 'unit_and_below' | 'org'> optional [ADR-0057 D1] Read depth: own
writeScope Enum<'own' | 'own_and_reports' | 'unit' | 'unit_and_below' | 'org'> optional [ADR-0057 D1] Write depth: own

PermissionSet

Properties

Property Type Required Description
name string ✅ Permission set unique name (lowercase snake_case)
label string optional Display label
isProfile boolean ✅ Whether this is a user profile
isDefault boolean ✅ [ADR-0056 D7] When true, this profile is the FALLBACK assigned to authenticated users who have no explicit grants — an app declares its default access posture here instead of relying on the built-in member_default. Foundation for SSO/JIT provisioning.
objects Record<string, Object> ✅ Entity permissions
fields Record<string, Object> optional Field level security
systemPermissions string[] optional System level capabilities
tabPermissions Record<string, Enum<'visible' | 'hidden' | 'default_on' | 'default_off'>> optional App/tab visibility: visible, hidden, default_on (shown by default), default_off (available but hidden initially)
rowLevelSecurity Object[] optional Row-level security policies (see rls.zod.ts for full spec)
contextVariables Record<string, any> optional Context variables for RLS evaluation