Member Junction
    Preparing search index...

    Function CheckAPIKeyScope

    • Check if an API key has the required scope for an operation.

      This function implements the three-tier permission model:

      1. User Permissions - What the user can do (already checked by authentication)
      2. Application Ceiling - Maximum scope the application allows
      3. API Key Scopes - Specific scopes granted to this key

      Parameters

      • apiKeyId: string

        The API key ID from context.userPayload.apiKeyId

      • scopePath: string

        The scope path required (e.g., 'view:run', 'agent:execute')

      • contextUser: UserInfo

        The authenticated user from context.userPayload.userRecord

      • options: ScopeAuthOptions = {}

        Additional options for scope checking

      Returns Promise<ScopeAuthResult>

      ScopeAuthResult with authorization details

      AuthorizationError if access is denied and throwOnDenied is true

      // In a resolver
      async runView(@Ctx() ctx: AppContext): Promise<ViewResult> {
        await CheckAPIKeyScope(
          ctx.userPayload.apiKeyId,
          'view:run',
          ctx.userPayload.userRecord,
          { resource: 'User' }
        );
        // ... proceed with operation
      }

    Settings

    Member Visibility