Determines if the current user (from Metadata.CurrentUser) can
execute the given authorization via a direct role match.
Client-side only. On the server, Metadata.CurrentUser is a global
singleton — it does not reflect the per-request user context. Use
UserCanExecute with an explicit user parameter instead.
Throws if no current user is set. Use CurrentUserCanExecuteWithAncestors for hierarchy-aware checking.
The authorization to check.
Optionalprovider: IMetadataProviderOptional metadata provider whose CurrentUser to evaluate against. Falls back to Metadata.Provider.
Determines if the current user can execute the given authorization, checking the authorization itself AND every ancestor up the hierarchy.
Granting "Schema Management" to a role therefore covers all descendant operations such as "Create in UDT Schema".
Client-side only. On the server, Metadata.CurrentUser is a global
singleton — it does not reflect the per-request user context. Use
UserCanExecuteWithAncestors with an explicit user parameter instead.
Throws if no current user is set.
The authorization to check (typically a leaf/child node).
Optionalprovider: IMetadataProviderOptional metadata provider whose CurrentUser to evaluate against. Falls back to Metadata.Provider.
true if the current user has auth or any ancestor auth.
Returns every authorization that user can execute via a direct role
match (no ancestor traversal).
The user to evaluate.
Optionalprovider: IMetadataProviderOptional metadata provider whose Authorizations list to scan. Falls back to Metadata.Provider.
Returns every authorization that user can execute, including those
reachable via ancestor grants.
Useful for building a complete "effective permission set" for a user without needing to know the exact hierarchy in advance.
The user to evaluate.
Optionalprovider: IMetadataProviderOptional metadata provider whose Authorizations list to scan. Falls back to Metadata.Provider.
Determines if user has the given authorization via a direct role
match only (no parent traversal).
The authorization to check.
The user whose roles are examined.
true if any of the user's roles is directly assigned to auth.
UserCanExecuteWithAncestors for hierarchy-aware checking.
Determines if user can execute auth by walking up the parent chain.
The check succeeds if the user has a direct role match on auth, or on
any ancestor (parent, grandparent, …). This respects the MemberJunction
convention that "users must have this authorization or a parent" to
access a feature — granting a broader parent implicitly covers children.
A visited-set guards against malformed circular parent references.
The authorization to check (start of the walk).
The user whose roles are examined.
OptionalallAuthorizations: AuthorizationInfo[]Optional pre-fetched list; defaults to
Metadata.Authorizations to avoid repeated
singleton lookups in hot paths.
true if the user passes the check at any level of the hierarchy.
const evaluator = new AuthorizationEvaluator();
const md = new Metadata();
const auth = md.Authorizations.find(a => a.Name === 'Create in UDT Schema');
// Returns true if user has 'Create in UDT Schema', 'Create Entities',
// 'Schema Management', or any other ancestor.
const allowed = evaluator.UserCanExecuteWithAncestors(auth, contextUser);
Centralised utility for evaluating MemberJunction authorization rules.
Hierarchy semantics
MemberJunction authorizations form a parent → child tree (e.g. "Schema Management" → "Create Entities" → "Create in UDT Schema"). Granting a parent authorization to a role implicitly covers every descendant operation — see UserCanExecuteWithAncestors.
Usage
Prefer UserCanExecuteWithAncestors for feature-gate checks so that administrators can grant access at whatever granularity fits their policy (root "Schema Management" for all database-designer ops, or a specific leaf for finer control). Use the plain UserCanExecute only when you explicitly need to verify a direct grant with no hierarchy traversal.
Multi-provider support
Authorizations and CurrentUser are per-provider state, so methods that need the provider accept an optional
providerparameter that takes precedence over the globalMetadata.Provider. Pass the provider explicitly when running in multi-provider client setups (parallel server connections); single-provider apps can omit it and rely on the global default.