Ace commands

configure registers the commands barrel. All commands boot the app and use the configured store.

authz:make-role

node ace authz:make-role editor

Create a role (idempotent).

authz:make-permission

node ace authz:make-permission posts.edit

Create a permission. Names may be dotted/wildcard (e.g. posts.*).

authz:grant

node ace authz:grant editor posts.edit

Grant a permission to a role (creating either by name as needed).

authz:assign

node ace authz:assign editor 42
node ace authz:assign editor 42 --type=admin --tenant=acme

Assign a role to a user. --type sets the polymorphic user type (default user); --tenant scopes the assignment (omit for the global scope).

authz:list

node ace authz:list

List every role (with its permissions) and every permission.

authz:sync

node ace authz:sync

Seed roles and permissions from the catalog declared in config/authz.ts. Idempotent — only missing rows are created/attached.

defineConfig({
  catalog: {
    permissions: ['system.manage'],
    roles: {
      editor: ['posts.*'],
      viewer: ['posts.view'],
    },
  },
})