Class PermissionAuthority

Stateful owner for permission evaluation, consumption, reload, and revoke.

Index

Constructors

Methods

authorize clearSessionGrants createConnectionAuthority explain grant reload replaceAdministratorGrants replaceConfiguredPolicy replaceProjectGrants revoke

Constructors

constructor

new PermissionAuthority(
policy: PermissionPolicy,
configuredAuthority?: PermissionAuthority,
): PermissionAuthority
Parameters
- policy: PermissionPolicy
- OptionalconfiguredAuthority: PermissionAuthority
Returns PermissionAuthority
- Defined in src/application/PermissionAuthority.ts:135

Methods

authorize

authorize(
    request: PermissionRequest,
    access: "read" | "write",
    options?: PermissionEvaluationOptions,
): PermissionAuthorizationResult
Canonicalize and authorize one exact operation before its side effect.
Parameters
- request: PermissionRequest
- access: "read" | "write"
- options: PermissionEvaluationOptions = {}
Returns PermissionAuthorizationResult
- Defined in src/application/PermissionAuthority.ts:152

clearSessionGrants

clearSessionGrants(): void
Drop once/session authority when its owning connection ends.

Returns void
- Defined in src/application/PermissionAuthority.ts:217

createConnectionAuthority

createConnectionAuthority(): PermissionAuthority
Create a connection-owned overlay for once and session grants.

Returns PermissionAuthority
- Defined in src/application/PermissionAuthority.ts:144

explain

explain(
    request: PermissionRequest,
    access: "read" | "write",
    options?: PermissionEvaluationOptions,
): PermissionAuthorizationResult
Dry-run the exact shared evaluation without consuming a once grant.
Parameters
- request: PermissionRequest
- access: "read" | "write"
- options: PermissionEvaluationOptions = {}
Returns PermissionAuthorizationResult
- Defined in src/application/PermissionAuthority.ts:165

grant

grant(grant: PermissionGrant): Result<PermissionPolicy>
Add authority beneath the administrator ceiling.
Parameters
- grant: PermissionGrant
Returns Result<PermissionPolicy>
- Defined in src/application/PermissionAuthority.ts:198

reload

reload(
ceilings: readonly PermissionScope[],
): Promise<Result<null, PermissionPathError>>
Replace ceilings without restarting the MCP process.
Parameters
- ceilings: readonly PermissionScope[]
Returns Promise<Result<null, PermissionPathError>>
- Defined in src/application/PermissionAuthority.ts:344

replaceAdministratorGrants

replaceAdministratorGrants(
grants: readonly PermissionGrant[],
): Promise<Result<null, PermissionPathError>>
Replace grants derived from the currently loaded administrator ceiling.
Parameters
- grants: readonly PermissionGrant[]
Returns Promise<Result<null, PermissionPathError>>
- Defined in src/application/PermissionAuthority.ts:289

replaceConfiguredPolicy

replaceConfiguredPolicy(
    configuration: {
        administratorGrants: readonly PermissionGrant[];
        ceilings: readonly PermissionScope[];
        projectGrants: readonly PermissionGrant[];
    },
): Promise<Result<null, PermissionPathError>>
Atomically replace reloadable ceilings and persisted grants.
Parameters
- configuration: {
      administratorGrants: readonly PermissionGrant[];
      ceilings: readonly PermissionScope[];
      projectGrants: readonly PermissionGrant[];
  }
Returns Promise<Result<null, PermissionPathError>>
- Defined in src/application/PermissionAuthority.ts:316

replaceProjectGrants

replaceProjectGrants(
grants: readonly PermissionGrant[],
): Promise<Result<null, PermissionPathError>>
Atomically replace optional persisted project grants.
Parameters
- grants: readonly PermissionGrant[]
Returns Promise<Result<null, PermissionPathError>>
- Defined in src/application/PermissionAuthority.ts:282

revoke

revoke(grantId: string): void
Revoke authority immediately for subsequent operations.
Parameters
- grantId: string
Returns void
- Defined in src/application/PermissionAuthority.ts:212