Skip to content

resolveGrantScopeAccess

resolveGrantScopeAccess(claims, options): GrantScopeAccess

Defined in: packages/contracts/src/supabase-rls.ts:885

The caller’s grant-scope standing, resolved from the JWT grants — the JS mirror of the whole policy predicate, both branches: ids is resolveGrantScopeIds (the scope-set subquery) and bypass mirrors the policy’s OR exists (…) branch. One declaration, two enforcement surfaces: pass the SAME options object you gave buildSupabaseGrantScopeNativePolicies and a bypass grant cannot be enforced on writes yet invisible on reads.

Never throws on malformed claims (they reach a customWhere unverified in shape) — a wrong shape simply confers nothing. A malformed grantsClaimPath/scopeIdField option is still a loud error.

{[key: string]: unknown; app_metadata?: {[key: string]: unknown; roles?: string[]; }; sub?: string; } | null

GrantScopeAccessOptions

GrantScopeAccess