Interface: AccessModel

server.AccessModel The supported model surface. Resource handles are added by defineAccessModel.

​

Hierarchy

• AccessChecks
• AccessGrants
• AccessPolicies ↳ AccessModel

​

Methods

​

require

▸ require(ctx, permission, type, key): Promise<GoverningResult>

​

Parameters

​

Returns

Promise<GoverningResult>

​

Inherited from

AccessChecks.require

---

​

check

▸ check(ctx, permission, type, key): Promise<AccessDecision>

​

Parameters

​

Returns

Promise<AccessDecision>

​

Inherited from

AccessChecks.check

---

​

checkMany

▸ checkMany(ctx, checks): Promise<AccessDecision[]>

​

Parameters

​

Returns

Promise<AccessDecision[]>

​

Inherited from

AccessChecks.checkMany

---

​

explain

▸ explain(ctx, permission, type, key): Promise<AccessExplanation>

​

Parameters

​

Returns

Promise<AccessExplanation>

​

Inherited from

AccessChecks.explain

---

​

requireSubject

▸ requireSubject(ctx, subject, permission, type, key): Promise<GoverningResult>

​

Parameters

​

Returns

Promise<GoverningResult>

​

Inherited from

AccessChecks.requireSubject

---

​

audited

▸ audited(ctx, permission, type, key): Promise<GoverningResult>

​

Parameters

​

Returns

Promise<GoverningResult>

​

Inherited from

AccessChecks.audited

---

​

permissionsOn

▸ permissionsOn(ctx, type, key): Promise<string[]>

​

Parameters

​

Returns

Promise<string[]>

​

Inherited from

AccessChecks.permissionsOn

---

​

reachableKeys

▸ reachableKeys(ctx, type, options?): Promise<string[]>

​

Parameters

​

Returns

Promise<string[]>

​

Inherited from

AccessChecks.reachableKeys

---

​

holders

▸ holders(ctx, type, key): Promise<{ on: string ; grants: GrantDocument[] ; rowGrants: { field: string ; role: string ; keys: string[] }[] ; directories: { table: string ; role: string }[] }[]>

​

Parameters

​

Returns

Promise<{ on: string ; grants: GrantDocument[] ; rowGrants: { field: string ; role: string ; keys: string[] }[] ; directories: { table: string ; role: string }[] }[]>

​

Inherited from

AccessChecks.holders

---

​

grant

▸ grant(ctx, input, options?): Promise<GenericId<string>>

​

Parameters

​

Returns

Promise<GenericId<string>>

​

Inherited from

AccessGrants.grant

---

​

recertify

▸ recertify(ctx, id, renewal, options): Promise<GenericId<string>>

​

Parameters

​

Returns

Promise<GenericId<string>>

​

Inherited from

AccessGrants.recertify

---

​

reviewDue

▸ reviewDue(ctx, args): Promise<null | GrantDocument>

​

Parameters

​

Returns

Promise<null | GrantDocument>

​

Inherited from

AccessGrants.reviewDue

---

​

expireGrant

▸ expireGrant(ctx, args): Promise<null>

​

Parameters

​

Returns

Promise<null>

​

Inherited from

AccessGrants.expireGrant

---

​

revokeAll

▸ revokeAll(ctx, type, key): Promise<number>

​

Parameters

​

Returns

Promise<number>

​

Inherited from

AccessGrants.revokeAll

---

​

inputs

▸ inputs(): string[]

​

Returns

string[]

​

Inherited from

AccessPolicies.inputs

---

​

policy

▸ policy(type, options?): AccessPolicy

​

Parameters

​

Returns

AccessPolicy

​

Inherited from

AccessPolicies.policy

---

​

grantsPolicy

▸ grantsPolicy(options?): AccessPolicy

​

Parameters

​

Returns

AccessPolicy

​

Inherited from

AccessPolicies.grantsPolicy

---

​

requestsPolicy

▸ requestsPolicy(): AccessPolicy

​

Returns

AccessPolicy

​

Inherited from

AccessPolicies.requestsPolicy

---

​

roleDefinitionsPolicy

▸ roleDefinitionsPolicy(): AccessPolicy

​

Returns

AccessPolicy

​

Inherited from

AccessPolicies.roleDefinitionsPolicy

---

​

protectGrants

▸ protectGrants(): TableDefinition<VObject<{ reason: undefined | string ; expiresAt: undefined | number ; subjectPermission: undefined | string ; object: string ; type: string ; subject: string ; role: string ; subjectKind: "group" | "user" ; subjectType: string }, { type: VString<string, "required"> ; object: VString<string, "required"> ; role: VString<string, "required"> ; subjectKind: VUnion<"group" | "user", [VLiteral<"user", "required">, VLiteral<"group", "required">], "required", never> ; subjectType: VString<string, "required"> ; subject: VString<string, "required"> ; subjectPermission: VString<undefined | string, "optional"> ; expiresAt: VFloat64<undefined | number, "optional"> ; reason: VString<undefined | string, "optional"> }, "required", "object" | "type" | "subject" | "role" | "reason" | "expiresAt" | "subjectKind" | "subjectType" | "subjectPermission">, { by_subject: ["subjectKind", "subjectType", "subject", "subjectPermission", "type", "object", "_creationTime"] ; by_object: ["type", "object", "subjectKind", "role", "subject", "_creationTime"] ; by_role: ["role", "type", "object", "_creationTime"] }, {}, {}, false>

​

Returns

TableDefinition<VObject<{ reason: undefined | string ; expiresAt: undefined | number ; subjectPermission: undefined | string ; object: string ; type: string ; subject: string ; role: string ; subjectKind: "group" | "user" ; subjectType: string }, { type: VString<string, "required"> ; object: VString<string, "required"> ; role: VString<string, "required"> ; subjectKind: VUnion<"group" | "user", [VLiteral<"user", "required">, VLiteral<"group", "required">], "required", never> ; subjectType: VString<string, "required"> ; subject: VString<string, "required"> ; subjectPermission: VString<undefined | string, "optional"> ; expiresAt: VFloat64<undefined | number, "optional"> ; reason: VString<undefined | string, "optional"> }, "required", "object" | "type" | "subject" | "role" | "reason" | "expiresAt" | "subjectKind" | "subjectType" | "subjectPermission">, { by_subject: ["subjectKind", "subjectType", "subject", "subjectPermission", "type", "object", "_creationTime"] ; by_object: ["type", "object", "subjectKind", "role", "subject", "_creationTime"] ; by_role: ["role", "type", "object", "_creationTime"] }, {}, {}, false>

​

Inherited from

AccessPolicies.protectGrants

---

​

protectRequests

▸ protectRequests(options): TableDefinition<VObject<{ expiresAt: undefined | number ; grant: undefined | string ; reviewer: undefined | string ; reviewerLabel: undefined | string ; comment: undefined | string ; object: string ; type: string ; updatedAt: number ; role: string ; reason: string ; status: "rejected" | "pending" | "withdrawn" | "approved" ; beneficiary: string ; requester: string ; requesterLabel: string ; acknowledged: boolean }, { type: VString<string, "required"> ; object: VString<string, "required"> ; role: VString<string, "required"> ; beneficiary: VString<string, "required"> ; expiresAt: VFloat64<undefined | number, "optional"> ; requester: VString<string, "required"> ; requesterLabel: VString<string, "required"> ; reason: VString<string, "required"> ; status: VUnion<"rejected" | "pending" | "withdrawn" | "approved", [VLiteral<"pending", "required">, VLiteral<"approved", "required">, VLiteral<"rejected", "required">, VLiteral<"withdrawn", "required">], "required", never> ; acknowledged: VBoolean<boolean, "required"> ; updatedAt: VFloat64<number, "required"> ; reviewer: VString<undefined | string, "optional"> ; reviewerLabel: VString<undefined | string, "optional"> ; comment: VString<undefined | string, "optional"> ; grant: VString<undefined | string, "optional"> }, "required", "object" | "type" | "updatedAt" | "role" | "reason" | "expiresAt" | "status" | "beneficiary" | "grant" | "requester" | "requesterLabel" | "acknowledged" | "reviewer" | "reviewerLabel" | "comment">, { by_status: ["status", "_creationTime"] ; by_requester: ["requester", "status", "_creationTime"] ; by_beneficiary: ["beneficiary", "status", "_creationTime"] ; by_resource: ["type", "object", "role", "status", "_creationTime"] }, {}, {}, false>

​

Parameters

​

Returns

TableDefinition<VObject<{ expiresAt: undefined | number ; grant: undefined | string ; reviewer: undefined | string ; reviewerLabel: undefined | string ; comment: undefined | string ; object: string ; type: string ; updatedAt: number ; role: string ; reason: string ; status: "rejected" | "pending" | "withdrawn" | "approved" ; beneficiary: string ; requester: string ; requesterLabel: string ; acknowledged: boolean }, { type: VString<string, "required"> ; object: VString<string, "required"> ; role: VString<string, "required"> ; beneficiary: VString<string, "required"> ; expiresAt: VFloat64<undefined | number, "optional"> ; requester: VString<string, "required"> ; requesterLabel: VString<string, "required"> ; reason: VString<string, "required"> ; status: VUnion<"rejected" | "pending" | "withdrawn" | "approved", [VLiteral<"pending", "required">, VLiteral<"approved", "required">, VLiteral<"rejected", "required">, VLiteral<"withdrawn", "required">], "required", never> ; acknowledged: VBoolean<boolean, "required"> ; updatedAt: VFloat64<number, "required"> ; reviewer: VString<undefined | string, "optional"> ; reviewerLabel: VString<undefined | string, "optional"> ; comment: VString<undefined | string, "optional"> ; grant: VString<undefined | string, "optional"> }, "required", "object" | "type" | "updatedAt" | "role" | "reason" | "expiresAt" | "status" | "beneficiary" | "grant" | "requester" | "requesterLabel" | "acknowledged" | "reviewer" | "reviewerLabel" | "comment">, { by_status: ["status", "_creationTime"] ; by_requester: ["requester", "status", "_creationTime"] ; by_beneficiary: ["beneficiary", "status", "_creationTime"] ; by_resource: ["type", "object", "role", "status", "_creationTime"] }, {}, {}, false>

​

Inherited from

AccessPolicies.protectRequests

---

​

protectRoleDefinitions

▸ protectRoleDefinitions(): TableDefinition<VObject<{ maxDuration: undefined | number ; type: string ; name: string ; scope: string ; permissions: string[] }, { scope: VString<string, "required"> ; type: VString<string, "required"> ; name: VString<string, "required"> ; permissions: VArray<string[], VString<string, "required">, "required"> ; maxDuration: VFloat64<undefined | number, "optional"> }, "required", "type" | "name" | "scope" | "permissions" | "maxDuration">, { by_scope: ["scope", "type", "name", "_creationTime"] }, {}, {}, false>

​

Returns

TableDefinition<VObject<{ maxDuration: undefined | number ; type: string ; name: string ; scope: string ; permissions: string[] }, { scope: VString<string, "required"> ; type: VString<string, "required"> ; name: VString<string, "required"> ; permissions: VArray<string[], VString<string, "required">, "required"> ; maxDuration: VFloat64<undefined | number, "optional"> }, "required", "type" | "name" | "scope" | "permissions" | "maxDuration">, { by_scope: ["scope", "type", "name", "_creationTime"] }, {}, {}, false>

​

Inherited from

AccessPolicies.protectRoleDefinitions

---

​

describe

▸ describe(): AccessDescription

​

Returns

AccessDescription

---

​

cedar

▸ cedar(): AccessCedarPolicies

​

Returns

AccessCedarPolicies

---

​

cedarEntities

▸ cedarEntities(tables, now, coverage?): AccessCedarEntities

​

Parameters

​

Returns

AccessCedarEntities

---

​

cedarContext

▸ cedarContext(identity): Record<string, unknown>

​

Parameters

​

Returns

Record<string, unknown>