Interface PermissionRule

Permission / access-control decorators for the ORM.

These decorators let you annotate model classes and individual fields with access rules — which roles can read, write, or are completely blocked from a field or an entire model. At query time you call filterByPermissions() to strip out any fields the current user is not allowed to see.

────────────────────────────────────────────────────────────────────────── Quick Reference ──────────────────────────────────────────────────────────────────────────

 @CanView('admin', 'manager')     — only these roles can read the field/model
 @CannotView('guest')             — these roles are DENIED read access
 @CanWrite('admin')               — only these roles can write the field
 @CannotWrite('guest')            — these roles are DENIED write access
 @Permission({ ... })             — full control with explicit allow/deny lists
Copy

────────────────────────────────────────────────────────────────────────── Example ──────────────────────────────────────────────────────────────────────────

// Field-level permissions (applied via static registration): PermissionRegistry.addFieldRule(User, 'ssn', { canView: ['admin'] }); PermissionRegistry.addFieldRule(User, 'salary', { canView: ['admin', 'hr'] }); PermissionRegistry.addFieldRule(User, 'password', { canView: [] }); // nobody

  // Class-level permission (applied via decorator):
  @CanView('admin', 'manager')
  class AuditLog extends Model { ... }

  // At request time:
  const currentRole = 'guest';
  const user = await User.findOne({ where: { id: 1 } });
  const safeUser = filterByPermissions(user, currentRole);
  // safeUser.ssn === undefined, safeUser.salary === undefined

  // Or get the allowed attribute list for a findAll() call:
  const attrs = getAllowedAttributes(User, currentRole);
  const users = await User.findAll({ attributes: attrs });
Copy