Define custom permissions

Vendure uses a fine-grained access control system based on roles & permissions. This is described in detail in the Auth guide. The built-in Permission enum includes a range of permissions to control create, read, update, and delete access to the built-in entities.

When building plugins, you may need to define new permissions to control access to new functionality. This guide explains how to do so.

Defining a single permission

For example, let's imagine you are creating a plugin which exposes a new mutation that can be used by remote services to sync your inventory. First of all we will define the new permission using the PermissionDefinition class:

src/plugins/inventory-sync/constants.ts

import { PermissionDefinition } from '@vendure/core';export const sync = new PermissionDefinition({    name: 'SyncInventory',    description: 'Allows syncing stock levels via Admin API'});

This permission can then be used in conjuction with the @Allow() decorator to limit access to the mutation:

src/plugins/inventory-sync/api/inventory-sync.resolver.ts

import { Mutation, Resolver } from '@nestjs/graphql';import { Allow } from '@vendure/core';import { sync } from '../constants';@Resolver()export class InventorySyncResolver {    @Allow(sync.Permission) // [!code highlight]    @Mutation()    syncInventory(/* ... */) {        // ...    }}

Finally, the sync PermissionDefinition must be passed into the VendureConfig so that Vendure knows about this new custom permission:

src/plugins/inventory-sync/inventory-sync.plugin.ts

import gql from 'graphql-tag';import { VendurePlugin } from '@vendure/core';import { InventorySyncResolver } from './api/inventory-sync.resolver'import { sync } from './constants';@VendurePlugin({    adminApiExtensions: {        schema: gql`            input InventoryDataInput {              # omitted for brevity            }                    extend type Mutation {              syncInventory(input: InventoryDataInput!): Boolean!            }        `,        resolvers: [InventorySyncResolver]    },    configuration: config => {        config.authOptions.customPermissions.push(sync); // [!code highlight]        return config;    },})export class InventorySyncPlugin {}

Define custom permissions

When building plugins, you may need to define new permissions to control access to new functionality. This guide explains how to do so.

Defining a single permission

src/plugins/inventory-sync/constants.ts

import { PermissionDefinition } from '@vendure/core';export const sync = new PermissionDefinition({    name: 'SyncInventory',    description: 'Allows syncing stock levels via Admin API'});

This permission can then be used in conjuction with the @Allow() decorator to limit access to the mutation:

src/plugins/inventory-sync/api/inventory-sync.resolver.ts

import { Mutation, Resolver } from '@nestjs/graphql';import { Allow } from '@vendure/core';import { sync } from '../constants';@Resolver()export class InventorySyncResolver {    @Allow(sync.Permission) // [!code highlight]    @Mutation()    syncInventory(/* ... */) {        // ...    }}

Finally, the sync PermissionDefinition must be passed into the VendureConfig so that Vendure knows about this new custom permission:

src/plugins/inventory-sync/inventory-sync.plugin.ts

import gql from 'graphql-tag';import { VendurePlugin } from '@vendure/core';import { InventorySyncResolver } from './api/inventory-sync.resolver'import { sync } from './constants';@VendurePlugin({    adminApiExtensions: {        schema: gql`            input InventoryDataInput {              # omitted for brevity            }                    extend type Mutation {              syncInventory(input: InventoryDataInput!): Boolean!            }        `,        resolvers: [InventorySyncResolver]    },    configuration: config => {        config.authOptions.customPermissions.push(sync); // [!code highlight]        return config;    },})export class InventorySyncPlugin {}

Define custom permissions

Defining a single permission

Define custom permissions

Defining a single permission

Custom CRUD permissions

Custom permissions for custom fields