Check a permission in all tenants with the Node.js SDK

permit.checkAllTenants() asks the policy decision point (PDP) in which tenants a user can perform an action on a resource, and returns those tenants. This reference is for Node.js developers of multi-tenant applications who need the list of tenants a user can act in, without one permit.check() call per tenant. For the concepts and examples in other languages, see Check a permission in all tenants.

Prerequisites

• A permit client created with an API key for the environment. See Create a Permit client.
• A container PDP. The Cloud PDP doesn't support the all-tenants check. See Run the PDP and Cloud PDP capabilities.
• Users with role assignments in one or more tenants.

checkAllTenants signature

Method	Signature
permit.checkAllTenants	checkAllTenants(user: IUser | string, action: string, resource: IResource | string, context?: Context, sdk?: string): Promise<TenantDetails[]>

checkAllTenants parameters

Name	Type	Required	Description
user	IUser or string	Yes	User key, or a user object with key and optional attributes.
action	string	Yes	Action to check, for example read.
resource	IResource or string	Yes	Resource type key, or a resource object with type and optional attributes. The PDP evaluates the check in every tenant, so it ignores a tenant in the resource.
context	Context	No	Extra context for the policy evaluation. Defaults to {}.
sdk	string	No	SDK identifier sent to the PDP. Defaults to node.

Example: call permit.checkAllTenants()

This example asks the PDP in which tenants the user employee1 can read a document, and prints the tenant keys:

const { Permit } = require('permitio');

const permit = new Permit({
  token: process.env.PERMIT_API_KEY,
  pdp: 'http://localhost:7766',
});

const main = async () => {
  const tenants = await permit.checkAllTenants({ key: 'employee1' }, 'read', 'document');
  console.log(tenants.map((tenant) => tenant.key));
};

main();

permit.checkAllTenants() resolves to one TenantDetails object per tenant in which the policy allows the action. With one allowing tenant named default, the script prints [ 'default' ], and with no allowing tenant it prints [].

permit.checkAllTenants() throws in permitio 2.7.6

In permitio 2.7.6, Enforcer.checkAllTenants() passes the Authorization header and the user, action, and resource fields as the request body, instead of passing the header in the request configuration and the fields at the top level of the body. The PDP receives a request with no Authorization header and answers 401 Unauthorized, so the method logs Error fetching all tenants: and rethrows the error. The method also reads an allowedTenants field from the response, while the PDP returns allowed_tenants.

Until a release fixes the method, call the PDP /allowed/all-tenants endpoint directly, as shown in Example: call the PDP all-tenants endpoint, or run the check per tenant with permit.check().

Example: call the PDP all-tenants endpoint

The SDK method sends a POST request to the /allowed/all-tenants endpoint of the PDP. The PDP listens on port 7766 by default. You can call the endpoint directly with the same fields: user, action, resource, and context. Replace <YOUR_API_KEY> with the environment API key you ran the PDP with. See the PDP API reference for the endpoint schema.

curl 'http://localhost:7766/allowed/all-tenants' \
  -X POST \
  -H 'Authorization: Bearer <YOUR_API_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{ "user": { "key": "employee1" }, "action": "read", "resource": { "type": "document" }, "context": {} }'

checkAllTenants return value

permit.checkAllTenants() resolves to an array of TenantDetails objects, one for each tenant in which the PDP allows the action. Each object has the tenant key and the tenant attributes. An empty array means the user can't perform the action in any tenant.

The PDP endpoint returns an object with an allowed_tenants array. Each item holds the decision fields of a regular check and a tenant object with key and attributes.

{
  "allowed_tenants": [
    {
      "allow": true,
      "tenant": {
        "key": "default",
        "attributes": {}
      }
    }
  ]
}

If the PDP request fails, permit.checkAllTenants() logs the error and rethrows it, so wrap the call in try/catch and decide there whether a failed lookup denies access.

To confirm the endpoint works, run the curl command in Example: call the PDP all-tenants endpoint against a running container PDP. The response lists one entry per tenant in which the policy allows the action.

Related pages

• Check a permission in all tenants
• Check permissions with the Node.js SDK
• PDP API reference