Premium

Permissions & field-level policies

Control which workflow actions and event fields an actor may change. Declarative policies provide consistent client-side behavior and explainable decisions before the engine accepts a mutation.

Loading interactive demo…

What you configure

permissionPolicies: Match actions, actors, roles, states, fields, and an optional predicate.
defaultPermission: Choose the fallback decision; the default is deny.
permissionDecision: Inspect a proposed action and changed-field set for an actor.

Essential integration

This assumes the shared Quick start already provides premiumLicense and, for UI views, premiumCalendarOptions. Only the feature-specific setup is shown.

import { EnterpriseCalendarWorkflow } from '@wts-calendar/core/enterprise-workflow';

const workflow = new EnterpriseCalendarWorkflow({
  license: premiumLicense,
  actor: { id: 'editor-1', roles: ['editor'] },
  online: false,
  autoFlush: false,
  events: [
    {
      id: 'release',
      title: 'Release window',
      start: '2026-09-07T09:00:00Z',
      end: '2026-09-07T10:00:00Z',
    },
  ],
  defaultPermission: 'deny',
  permissionPolicies: [
    {
      id: 'editor-update',
      effect: 'allow',
      actions: ['update', 'flush'],
      roles: ['editor'],
    },
    {
      id: 'protect-resource',
      effect: 'deny',
      actions: ['update'],
      roles: ['editor'],
      fields: ['resourceId'],
    },
    {
      id: 'manager-update',
      effect: 'allow',
      actions: ['update', 'flush'],
      roles: ['manager'],
    },
  ],
});

const event = workflow.getEvent('release')?.event;
export const canEditTitle = workflow.permissionDecision('update', event, ['title']);
export const canEditResource = workflow.permissionDecision('update', event, [
  'resourceId',
]);
// Use decisions to disable fields; submit also enforces the same runtime policies.
await workflow.submit({
  type: 'update',
  eventId: 'release',
  changes: { title: 'New title' },
});

Behavior and lifecycle

Deny policies take precedence over allow policies.
Field rules can restrict a resource reassignment while allowing another event field to be edited.

Limits and responsibilities

These policies govern the workflow engine, not every possible direct write to application data.
Browser permissions are a user-experience boundary, not a replacement for server authorization.

Premium

Enable this capability

Optional module: @wts-calendar/core/enterprise-workflow
Local capability ID: enterprise-workflow · enabled by package-wide Premium

Use the request form to describe your project and deployment origins. Pricing and terms are confirmed privately. A WTS license is separate from provider credentials; do not send passwords or production access tokens.

The live example uses a browser-visible deployment key restricted to this package and approved origins. It does not collect license keys or visitor credentials.