@reactor-cloud/permissions

Permissions client for Reactor. Per-record grants, checks, and flat groups.

Installation

npm install @reactor-cloud/permissions @reactor-cloud/shared

Or use the unified client:

npm install @reactor-cloud/client

Quick Start

import { PermissionsClient } from '@reactor-cloud/permissions';

const permissions = new PermissionsClient(ctx);

// Grant a relation on a specific row
await permissions.grant({
  subject: { type: 'user', id: userId },
  relation: 'read',
  target: { type: 'deals', id: dealId },
});

// Check access (defaults to the calling user when `subject` is omitted)
const { data: allowed } = await permissions.check({
  relation: 'read',
  target: { type: 'deals', id: dealId },
});

// Revoke the same tuple
await permissions.revoke({
  subject: { type: 'user', id: userId },
  relation: 'read',
  target: { type: 'deals', id: dealId },
});

// Or revoke by grant id
await permissions.revokeById(grantId);

// List all grants on a row
const { data: grants } = await permissions.listGrants({ type: 'deals', id: dealId });

Read-side helpers

// Which rows can the caller read? (bounded)
const { data } = await permissions.objects('deals', 'read');

// Who can read this row?
const { data: subjects } = await permissions.subjects({ type: 'deals', id: dealId }, 'read');

Groups

const { data: group } = await permissions.groups.create('sales-team');
await permissions.groups.addMember(group.id, { type: 'user', id: userId });

// Grant to a whole group
await permissions.grant({
  subject: { type: 'group', id: group.id },
  relation: 'read',
  target: { type: 'deals', id: dealId },
});

await permissions.groups.removeMember(group.id, { type: 'user', id: userId });

With the unified client

import { createClient } from '@reactor-cloud/client';

const reactor = createClient('https://api.example.com', { key: 'rk_pub_...' });
await reactor.permissions.grant({
  subject: { type: 'user', id: userId },
  relation: 'read',
  target: { type: 'deals', id: dealId },
});

Grants are enforced at the data layer through auth.can() / auth.cannot() policy builtins, so a select policy that uses auth.can('read') automatically filters rows to those the caller has been granted access to.

License

MIT