permissions

Permission alignment ensures client-side actions and server-side functions check identical permission constants. Use the same TEAM_PERMISSIONS constant on both sides with hasTeamPermission and requireTeamPermission to prevent authorization failures and maintain consistency across your application.

hasTeamPermission checks if a user has a specific permission and returns a boolean, allowing conditional logic. requireTeamPermission throws an error if the permission is missing, halting execution. Choose requireTeamPermission for critical operations and hasTeamPermission for optional features.

Team-based permissions isolate authorization to specific teams in multi-tenant systems. Including teamId in every check ensures users can only access resources within their assigned team, preventing cross-team data leaks and maintaining security boundaries.

Identify the specific permission your feature needs from TEAM_PERMISSIONS constants. Call hasTeamPermission or requireTeamPermission with the permission and teamId on the client before dispatching actions, then repeat the same check on the server function to align validations.

Yes, granular permissions like EDIT_COMPONENTS are preferred over broad catch-all permissions. They provide fine-grained control over specific actions, reduce security surface area, and make authorization intent explicit in your codebase.

Misaligned permissions cause authorization failures where users can trigger client-side actions that fail on the server. Use the same permission constant and validation pattern on both sides, and integrate with src/utils/team-auth.ts utilities to maintain consistency.