resolveGrantScopeAccess
resolveGrantScopeAccess(
claims,options):GrantScopeAccess
Defined in: packages/contracts/src/supabase-rls.ts:885
The caller’s grant-scope standing, resolved from the JWT grants — the JS mirror of the whole policy
predicate, both branches: ids is resolveGrantScopeIds (the scope-set subquery) and bypass
mirrors the policy’s OR exists (…) branch. One declaration, two enforcement surfaces: pass the SAME
options object you gave buildSupabaseGrantScopeNativePolicies and a bypass grant cannot be
enforced on writes yet invisible on reads.
Never throws on malformed claims (they reach a customWhere unverified in shape) — a wrong shape
simply confers nothing. A malformed grantsClaimPath/scopeIdField option is still a loud error.
Parameters
Section titled “Parameters”claims
Section titled “claims”{[key: string]: unknown; app_metadata?: {[key: string]: unknown; roles?: string[]; }; sub?: string; } | null