basalt / permissions/src / ScopeRequiredError

Class: ScopeRequiredError

Defined in: permissions/src/errors.ts:118

A grant write (assignRole, grantToUser, grantTemporarily, delegate…) was made with no explicit scope, in a multi-tenant app, while no tenant is in the context. Defaulting to the global scope there would turn a tenant administration call — say, on a request whose tenant failed to resolve — into a platform-wide grant, so the write fails closed. Pass the scope explicitly (a tenant id, or GLOBAL_SCOPE when a global grant is really meant), run it inside the tenant's context, or build the Gate with allowGlobalWrites: true.