Interface EffectiveAccessClient

Typed client over the gateway's self-scoped effective-access surface.

interface EffectiveAccessClient {
    batchCan(
        request: EffectiveAccessRequest & { items: EffectiveAccessBatchItem[] },
    ): Promise<EffectiveAccessBatchResult[]>;
    can(request: EffectiveAccessRequest): Promise<EffectiveAccessDecision>;
    summary(companyId?: string): Promise<EffectiveAccessSummary>;
}

Index

Methods

batchCan can summary

Methods

batchCan

batchCan(
request: EffectiveAccessRequest & { items: EffectiveAccessBatchItem[] },
): Promise<EffectiveAccessBatchResult[]>
POST /api/auth/effective-access/batch-can — one decision per item, sharing the base request's scope/company/role fields (batchCanRequestWire embeds canRequestWire).
Parameters
- request: EffectiveAccessRequest & { items: EffectiveAccessBatchItem[] }
Returns Promise<EffectiveAccessBatchResult[]>
- Defined in effectiveAccess.ts:30

can

can(request: EffectiveAccessRequest): Promise<EffectiveAccessDecision>
POST /api/auth/effective-access/can — one decision, self-scoped (the gateway forwards to authz's /internal/authz/effective-access/can, which rejects any body naming a different subject than the bearer).
Parameters
- request: EffectiveAccessRequest
Returns Promise<EffectiveAccessDecision>
- Defined in effectiveAccess.ts:27

summary

summary(companyId?: string): Promise<EffectiveAccessSummary>
GET /api/auth/effective-access/summary[?companyId=] — the caller's own EffectiveAccessSummary (apiVersion 1): featureKeys/roleBindings/objectAccess for shell nav/feature gating. kcSub is gateway-injected from the bearer; there is no way to ask for anyone else's summary through this client. companyId is optional — omit for the global-scope-only fields.
Parameters
- OptionalcompanyId: string
Returns Promise<EffectiveAccessSummary>
- Defined in effectiveAccess.ts:37