abilityDigest

abilityDigest(context?): string | undefined

Defined in: packages/pipeline-casl/src/helpers/ability-digest.ts:36

A digest of the permissions the current ability grants: the SHA-256 (hex) of its rules in order, with every condition already resolved against the principal. Any change that can change a decision — a rule, its order, inversion, fields, or a principal value a condition interpolates — changes the digest.

Use it as the permission-scope segment of a response cache key, or as an idempotency replay scope. It identifies a set of permissions, not a caller: two principals with identical effective rules share a digest, so combine it with the principal wherever the key must separate callers.

Parameters

context?

IPipelineContext<unknown, unknown>

The pipeline execution; omitted, the running one.

Returns

string | undefined

The 64-character hex digest, or undefined when no ability is present (CaslBehavior has not run, or runs outside a pipeline).

Throws

When a rule holds a value that is not plain JSON, such as a RegExp condition.

Example

const cacheKey = createPartitionedCacheKeyFactory({
  principal: (ctx) => getCaslPrincipal(ctx)?.id,
  scope: abilityDigest,
});
const replay = idempotent({ keyFactory, replayScopeFactory: abilityDigest });