Class: RoleRegistry<S>
Defined in: packages/polizy/src/role-registry.ts:107
Type Parameters
S
S extends AnyRoleScaffoldedSchema
Constructors
Constructor
new RoleRegistry<
S>(authz,schema,opts?):RoleRegistry<S>
Defined in: packages/polizy/src/role-registry.ts:115
Parameters
authz
AuthSystem<S>
schema
S
opts?
catalog?
Returns
RoleRegistry<S>
Methods
assignRole()
assignRole(
user,role,when?):Promise<void>
Defined in: packages/polizy/src/role-registry.ts:255
Assign a subject to a role (optionally time-boxed/conditional).
Parameters
user
AnyObject<SchemaObjectTypes<S>> | Subject<SchemaSubjectTypes<S>>
role
RoleRef<S>
when?
Returns
Promise<void>
defineRole()
defineRole(
args):Promise<RoleRef<S>>
Defined in: packages/polizy/src/role-registry.ts:192
Define a custom role and (optionally) its initial capabilities. Caps are
written on on (default: the tenant), so a workspace-scoped role grants its
actions across the workspace (and its hierarchy descendants).
Parameters
args
can
readonly GrantableAction<S>[]
label?
string
name
string
on?
AnyObject<SchemaObjectTypes<S>>
tenant
AnyObject<SchemaObjectTypes<S>>
when?
Returns
Promise<RoleRef<S>>
deleteRole()
deleteRole(
role):Promise<{caps:number;members:number; }>
Defined in: packages/polizy/src/role-registry.ts:292
Delete a role: cascade its capabilities, then its memberships.
Parameters
role
RoleRef<S>
Returns
Promise<{ caps: number; members: number; }>
getRolePermissions()
getRolePermissions(
role):Promise<GrantableAction<S>[]>
Defined in: packages/polizy/src/role-registry.ts:313
The actions a role currently grants (derived from its capability tuples).
This retrieves all actions granted across all objects (any scope) that the role has capabilities on, unlike permissionMatrix which only returns capabilities scoped directly to the tenant object.
Parameters
role
RoleRef<S>
Returns
Promise<GrantableAction<S>[]>
grantToRole()
grantToRole(
role,action,on?,when?):Promise<void>
Defined in: packages/polizy/src/role-registry.ts:223
Add a capability to a role at runtime (idempotent). Toggles a matrix cell on.
Parameters
role
RoleRef<S>
action
on?
AnyObject<SchemaObjectTypes<S>>
when?
Returns
Promise<void>
listRoleMembers()
listRoleMembers(
role):Promise<Subject<SchemaSubjectTypes<S>>[]>
Defined in: packages/polizy/src/role-registry.ts:325
The subjects assigned to a role.
Parameters
role
RoleRef<S>
Returns
Promise<Subject<SchemaSubjectTypes<S>>[]>
listRoles()
listRoles(
tenant):Promise<object[]>
Defined in: packages/polizy/src/role-registry.ts:344
List the roles defined in a tenant (with labels and granted actions).
Parameters
tenant
AnyObject<SchemaObjectTypes<S>>
Returns
Promise<object[]>
permissionMatrix()
permissionMatrix(
tenant):Promise<PermissionMatrix<S>>
Defined in: packages/polizy/src/role-registry.ts:366
Build a permissions matrix for a tenant in a single capability read: the fixed permission rows plus every role column with the actions it grants. The natural backing for an "add role + click-to-toggle" UI.
This only reads capability tuples scoped directly to the tenant object, unlike getRolePermissions which returns actions granted across all objects that the role has capabilities on.
Parameters
tenant
AnyObject<SchemaObjectTypes<S>>
Returns
Promise<PermissionMatrix<S>>
revokeFromRole()
revokeFromRole(
role,action,on?):Promise<void>
Defined in: packages/polizy/src/role-registry.ts:240
Remove a capability from a role. Toggles a matrix cell off.
Parameters
role
RoleRef<S>
action
on?
AnyObject<SchemaObjectTypes<S>>
Returns
Promise<void>
roleRef()
roleRef(
tenant,name):RoleRef<S>
Defined in: packages/polizy/src/role-registry.ts:167
Construct a typed reference to a role by tenant + name (deterministic id).
Tenant IDs and role names are restricted to prevent "/" characters, ensuring that roles can be uniquely parsed back from their generated composite IDs without cross-tenant prefix conflicts.
Parameters
tenant
AnyObject<SchemaObjectTypes<S>>
name
string
Returns
RoleRef<S>
unassignRole()
unassignRole(
user,role):Promise<void>
Defined in: packages/polizy/src/role-registry.ts:280
Remove a subject from a role.
Parameters
user
AnyObject<SchemaObjectTypes<S>> | Subject<SchemaSubjectTypes<S>>
role
RoleRef<S>
Returns
Promise<void>