Interface: ACLRecord
Defined in: service-core/src/security/AccessControlList.ts:45
The ACLRecord interface describes a single permissions entry in an AccessControlList that grants a set of
actions to a single user or role.
actions is an arbitrary list of action strings the user or role is granted for the entity. The conventional
CRUD actions are defined in ACLAction, but any string may be used to express custom, service-specific
permissions. The sentinel value ACLAction.FULL ("*") grants every action and supersedes all others.
If no record matches a given user or role, permission is looked up on the parent ACL (see parentUid)
instead. There is no per-action inheritance within a single matched record — if a record matches, only the
actions it explicitly lists are granted.
ACLs can be chained via single inheritance through the specification of the parentUid. This allows the ability to
create complex trees of permissions that can easily inherit control schemes to make the definition of permissions
easier.
Properties
actions
actions:
string[]
Defined in: service-core/src/security/AccessControlList.ts:54
The list of actions this user or role is granted for the entity. ACLAction.FULL ("*") grants everything.
userOrRoleId
userOrRoleId:
string
Defined in: service-core/src/security/AccessControlList.ts:49
The unique identifier of the user or role that the record belongs to.