Hi team, We're using the Node SDK (

permitio@2.7.5

) with a local PDP (

pdp-v2:latest

) for a ReBAC setup with resource-scoped roles and role derivations. The issue: When calling

getUserPermissions

, the PDP response includes a

roles

array per resource instance:

{
  "task:task-001": {
    "permissions": ["task:view", "task:edit", ...],
    "roles": ["some_role"],
    "resource": { "type": "task", "key": "task-001" }
  }
}

However, the SDK's TypeScript types (

ResourcePermissions

/

TenantPermissions

in

enforcement/interfaces.ts

) don't declare the

roles

field. We have to use a type assertion to access it. Is this an intentional omission or a missing type? Should we be using a different method to get the user's roles on a specific resource instance? Thanks!

Hi @Uladzislava Sheleh, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.

Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?

Looking at the Node SDK source code, the TypeScript interface definition in

src/enforcement/interfaces.ts

shows: (1)

interface TenantPermissions {
  permissions: string[];
  tenant?: {
    key: string;
    attributes: {
      [id: string]: any;
    };
  };
}

You're correct—the

roles

field is not included in the

TenantPermissions

or

ResourcePermissions

type definitions, even though the PDP does return it in the response. The

getUserPermissions

method in the enforcer expects the response to match

IUserPermissions

, which is structured as an object with resource identifiers as keys and permission details as values. (2) The enforcer extracts permissions from either an OPA-style result wrapper or directly from the response data:

const permissions =
  (isOpaGetUserPermissionsResult(response.data)
    ? response.data.result.permissions
    : response.data) || {};

This appears to be a missing type definition rather than an intentional omission. The PDP is returning the

roles

array as part of the resource permissions data, but the SDK's TypeScript interfaces haven't been updated to reflect this. For now, you'll need to continue using type assertions to access the

roles

field. You might want to report thi

Hi @Uladzislava Sheleh, thanks for bringing this to our attention. I will relay this to the team and we will update the typescript sdk