#EffectivePermissionsProvider

#Import

1import { EffectivePermissionsProvider } from "alepha/security";

#Overview

The caller's effective permission set, computed once, server-side.

#Why the final answer and not the raw material

Effective access is application permission AND <whatever else narrows it>. The client could be sent the pieces and asked to intersect them, and that is precisely what must not happen: two implementations of one rule, on two sides of a wire, is how a sidebar and an endpoint come to disagree about who may do something - and the disagreement is invisible until somebody with an unusual rank complains that a button does nothing.

So the client receives a flat list of short strings, its own, and its only operation is includes.

#What is here and what is not

Only the application layer is: the catalogue, the role grant, the privileged bypass and the permission scope. Everything that narrows FURTHER is the application's, passed in as EffectivePermissionsOptions.narrow. A rank, a per-project capability, a subscription tier and a feature flag are all the same shape from here, so adding one is a new predicate rather than a change to this class.

#It performs no I/O, deliberately

resolve is synchronous. Whatever a narrowing factor needs - a rank's granted list, a row of entitlements - the caller has already read by the time its gate ran, and passes in. An extraction that fetched would cost a query on every path that uses it, which is the property being preserved: a plain member costs no extra read.