TypeScript API
What @zynactra/access, -drizzle, -nest and -react export.
ESM packages for Node 22 or later (React: any bundler). Every export has TSDoc comments; your editor shows them. The NestJS guide and React guide show them in use.
@zynactra/access
new Access(config) | Build from { manifest, cerbos, store, resolver?, ... }. Options. |
access.hasPermission(s, key) | Holds key at some scope? From cached grants; the route guard. |
access.check(s, key, resource) | One decision, Promise<boolean>; rejects on outages. |
access.assert(s, key, resource) | Resolves when allowed, otherwise throws AccessError (outages: reason unavailable). |
access.checkMany(s, items) | { resource, permissions }[] to { resource, allowed: Record<string, boolean> }[], one Cerbos call. |
access.plan(s, key) | The list filter's input. |
access.explain(s, key, resource) | An Explanation. |
access.summary(s) | The subject's grants, as GET /access/me returns them. |
access.invalidate(orgId, userId?), access.invalidateAll() | Drop cached grants. |
parseManifest(json) | The compiled manifest (zaccess gen's out.ts or access.manifest.json) as a Manifest. |
new CerbosHTTP(baseUrl) | The Cerbos client (check, plan, healthy); Cerbos is its interface. |
planToSql(plan, columns, { startAt?, placeholder? }) | A plan as { sql, params }; same output as Go's sqlfilter. escapeLike(s). |
new AdminService(access, store) | The admin API: listRoles, createRole, updateRole, setRolePermissions, deleteRole, listAssignments, createAssignment, previewAssignment, revokeAssignment, listGroupMappings, createGroupMapping, deleteGroupMapping, listChanges, explain, each taking the acting subject first. |
bootstrapAdmin(access, store, orgId, userId) | An org's first access_admin. |
AccessError | code, reason, permission, field, callId, detail. |
withRequirement(permission, fn) | Strict requirement tracking around a handler, outside Nest. |
Types: Subject, Resource, Resolver, Store, AdminStore, Plan, Explanation, Summary, Role, Assignment, GroupMapping, Change. Constants: ScopeGlobal, ScopeSelf, ModeInherit, AdminRole, the Perm* admin permission keys, MaxBreakGlassMs.
@zynactra/access/testing
startCerbos(policiesDir) (a PDP: { url, client, stop }), staticResolver({ attrs, sets }), memStore(rows), cerbosBin(), requireLive(), repoRoot().
@zynactra/access-drizzle
new PgStore(pool) | The Postgres store over a pg pool (with Drizzle, db.$client). syncCatalog(manifest), ensureOrg(manifest, orgId), getRoleByKey(orgId, key), and the Store / AdminStore methods. |
migrate(pool) | Apply the access schema migrations. migrations lists them. |
listen(config, access, { onError?, onReady?, maxBackoffMs? }) | LISTEN for changes and invalidate caches; reconnects with backoff. Returns stop(). |
drizzleFilter(plan, columns) | A plan as a Drizzle SQL condition over bound columns. |
@zynactra/access-nest
AccessModule.forRoot(options), forRootAsync({ useFactory, inject, path }) | The global guard, the requirement interceptor, the problem filter and (with admin) the access API controllers. |
@RequirePermission(key), @RequireCapability(key), @AccessPublic() | Route declarations. Undeclared routes are denied by default. |
@CurrentSubject() | The subject, or 401. |
ACCESS, ACCESS_ADMIN, ACCESS_OPTIONS | Injection tokens for the Access, the AdminService and the options. |
Loader | (subject, ids) => Promise<Record<string, Resource>>, for /check and /explain. |
toProblem(err), statusFor(code) | Errors as RFC 9457 problems. |
@zynactra/access-react
createAccessClient({ baseUrl?, headers?, fetch?, credentials? }) | A typed client for the whole access API. Errors are AccessApiError. |
<AccessProvider client initialSummary?> | Loads /me and batches record checks. |
useAccess() | { client, summary, loading, error, has(key), refresh() }. |
useCan(key, id?) | { allowed, loading, error }. |
<Can permission id? fallback? loading?> | Render children when allowed. |
@zynactra/access-react/admin
AccessAdmin (all tabs), the panels RolesPanel, AssignmentsPanel, GroupMappingsPanel, ChangeLogPanel, ExplainPanel, the dialogs AssignDialog, RoleEditor, the pickers UserPicker, ScopeIdsPicker, PersonCell, and ErrorAlert, describeError. See Admin screens.
@zynactra/access-react/testing
fakeAccessApi(options), adminSummary, globalGrant(). See React.