DomainAccessDelta
Defined in: js-api/src/domains.ts:641
The access changes an apply carries (DomainApplyBody.access): exact permission-triple
deltas, executed in the registry transaction under the deploy lock AFTER the manifest change,
so a column added and restricted in one apply is never visible to today's readers and
writable turned on never activates a grant the same apply revokes. Every op needs Share on
its target (a column's: the table's core schema), or the whole apply is refused
('access-forbidden', naming the targets); a target the same apply drops is refused too
('access-target-dropped' — the purge owns it). A triple both granted and revoked, or a column
named by two restriction ops, is 'invalid-access'.
Properties
| Property | Type | Description | Defined in |
|---|---|---|---|
grant? | DomainGrantTriple[] | Table grants to add. | js-api/src/domains.ts:643 |
restrict? | DomainColumnRestriction[] | Columns to restrict, with the deltas on their readers and editors. | js-api/src/domains.ts:647 |
revoke? | DomainGrantTriple[] | Table grants to remove. | js-api/src/domains.ts:645 |
unrestrict? | DomainColumnUnrestriction[] | Columns to make visible to everyone again (their per-column schema and its grants go). | js-api/src/domains.ts:649 |