Charter · Role syntax

Multiple roles

A principal with more than one role is granted the union of the ids its roles resolve to. A deny applies only to the role it is written on and does not remove ids granted through another role. In the example member denies door.*, usher allows it, and Linus has both roles, so door.list is granted.

Charter

{
  member: {
    allow: ['programme', 'seats', 'me.*'],
    deny: ['door.*'],
  },
  usher: ['programme', 'door.*'],
}

Action ids

[
  'welcome',
  'programme',
  'seats',
  'me.tickets',
  'me.pass',
  'door.list',
  'members',
  'takings',
  'settings',
]

Roles

['member', 'usher']

Resolved ids

[
  'programme',
  'seats',
  'me.tickets',
  'me.pass',
  'door.list',
]

Output matches the expected value

Runs in this page on the installed package. The input and the expected output are defined by the example.