Configuration

Every option of Access, the guard, the access API and the Nest module, and the environment variables tests read.

Access

Go (`access.Config`)	TypeScript (`AccessConfig`)	Default
`Manifest`	`manifest`	required	The compiled manifest (`accessgen.Manifest`, `parseManifest(...)`).
`Cerbos`	`cerbos`	required	`access.NewCerbosHTTP(url)` / `new CerbosHTTP(url)`.
`Store`	`store`	required	`sqlstore.New(db)` / `new PgStore(pool)`.
`Resolver`	`resolver`	no-op	Principal attributes and set expansion. A no-op resolver switches prefix grants off and expands nothing.
`CacheTTL`	`cacheTtlMs`	60 s	How long a subject's grants are cached. Negative disables the cache.
`CacheSize`	`cacheSize`	10000	Subjects cached.
`Timeout`	`timeoutMs`	250 ms	Per Cerbos call; each call retries once.
`Strict`	`strict`	off	Programmer errors become `invalid` errors. Turn on in development and tests.
`Logger`	`logger`	`slog.Default()` / console
`Now`	`now`	the clock	For tests.

Route guard (Go)

accesshttp.Guard:

Field
`Access`	The `*access.Access`.
`Strict`	A guarded route that returns success without checking its permission against a record fails with 500. Responses are buffered to make that possible.
`Logger`	Where missing checks are logged when `Strict` is off.

Access API (Go)

accesshttp.Config for accesshttp.Handler:

Field	Default
`Service`	required	The `*admin.Service`.
`Loaders`	none	Record loaders by kind, for `/check` and `/explain`. A kind without one is refused with 400.
`MaxChecks`	100	Most items in one `/check`.
`Logger`	`slog.Default()`

Nest module

AccessModule.forRoot(options):

Option	Default
`access`	required	The `Access` instance.
`subject(req)`	required	Reads the authenticated subject; return `undefined` when there is none.
`admin`	none	With an `AdminService`, the access API is served.
`path`	`"access"`	Where the API is served.
`loaders`	none	Record loaders by kind.
`strict`	`false`	Strict requirement tracking. Don't use `@Res()` on guarded routes.
`denyUndeclared`	`true`	Deny routes with no access decorator.
`global`	`true`	Register the guard, interceptor and filter globally.
`maxChecks`	100	Most items in one `/check`.
`logger`	console

forRootAsync({ useFactory, inject, path, api? }) takes the same options from a factory; path is fixed at import time because Nest needs controller paths early.

React client

createAccessClient(options):

Option	Default
`baseUrl`	`"/access"`	Where the API is mounted.
`headers()`	none	Extra headers per request, such as `Authorization`. May be async.
`credentials`	`"same-origin"`	Passed to `fetch`.
`fetch`	`globalThis.fetch`	For tests (`fakeAccessApi`) and custom transports.

Environment variables for tests

Variable
`ACCESS_TEST_DATABASE_URL`	A Postgres the test helpers can create and drop databases on.
`CERBOS_BIN`	The `cerbos` binary, when it isn't on `PATH`.
`ACCESS_REQUIRE_LIVE=1`	Fail, instead of skip, tests that need Postgres or Cerbos. Set it in CI.