Presets

Presets automatically set column values on write operations. The user cannot override preset values — they are injected by the engine after permission checks.

permissions: {
  create_orders: {
    name: 'Create orders',
    table: 'main.orders',
    operations: { insert: true },
    columns: ['amount', 'status', 'customer_id'],
    preset: {
      created_by: '$user.id',
      organization_id: '$user.current_org_id',
    },
  },
}

When a user inserts an order, created_by and organization_id are automatically set from the session — even if the user sends different values in the request body.

How Presets Work

1. User sends request body: { amount: 500, status: 'draft' }
2. Engine resolves preset variables: $user.id becomes 'usr_123'
3. Preset values are merged into the request body, overriding any user-provided values
4. Final insert: { amount: 500, status: 'draft', created_by: 'usr_123', organization_id: 'org_456' }

$user.* Variables

Presets reference the session object returned by resolveSession. Any property on the session object is available:

The available variables depend on what your resolveSession function returns.

Common Patterns

Audit Columns on Insert

preset: {
  created_by: '$user.id',
  created_at: '$now',
}

Audit Columns on Update

preset: {
  updated_by: '$user.id',
  updated_at: '$now',
}

Organization Scoping

Ensure records always belong to the user's current organization:

preset: {
  organization_id: '$user.current_org_id',
}

Combined Insert Permission

permissions: {
  create_orders: {
    name: 'Create orders',
    table: 'main.orders',
    operations: { insert: true },
    columns: ['amount', 'status', 'customer_id'],
    check: {
      amount: { $gte: 0 },
      status: { $in: ['draft'] },
    },
    preset: {
      created_by: '$user.id',
      organization_id: '$user.current_org_id',
    },
  },
}

This permission:

• Allows inserting amount, status, and customer_id
• Validates that amount >= 0 and status is 'draft'
• Automatically sets created_by and organization_id

Preset vs. Check

Static Values

Presets can also use static values instead of session variables:

preset: {
  source: 'api',
  version: 2,
}