Globals

A global is a single document rather than a collection of many — site settings, a header menu, a homepage layout. Because there is only ever one document and you never create or delete it through the API, globals have just two access rules: read and update.

Read the Access Control overview first for the shared model — the four rule shapes and the context a rule receives. This page covers the two rules a global supports.

For self-hosted globals, function rules are also available when a singleton update needs local server logic or infrastructure checks.

The shape

Attach read and update to the access key of a global. A typical setup makes settings readable by anyone (so your frontend can render them) while restricting edits to admins:

import { defineGlobal } from '@dyrected/core'

export const SiteSettings = defineGlobal({
  slug: 'site-settings',
  access: {
    read: true,
    update: "'admin' in user.roles",
  },
  fields: [
    // ...
  ],
})

How operations map to requests

There are no create or delete rules — a global always exists and cannot be removed through the API, so those operations do not apply.

The two operations

Read

read decides who can fetch the global. Settings that your public site needs to render — a site title, social links, a footer — are usually readable by everyone:

access: {
  read: true,
}

If a global holds internal configuration, require a user instead:

access: {
  read: 'user != null',
}

Update

update decides who can change the global. This is almost always restricted, since a global usually controls site-wide behavior:

access: {
  update: "'admin' in user.roles",
}

What a global rule receives

Global rules run on the server with the standard access context. The useful values here are:

• user and req, as always
• doc — the current stored global
• data — the incoming update payload

That makes globals practical for rules that depend on the stored value or the change being made.

For self-hosted Dyrected, a function rule can inspect the stored document and incoming payload directly. For example, allow updates only while the global is unlocked, and inspect the incoming payload with data:

access: {
  read: ({ doc }) => doc?.visibility === 'public',
  update: ({ doc, data }) => !doc?.locked && data?.locked !== true,
}

Default access

If you omit a rule, that operation is open. A global with no access block can be read and updated by anyone who can reach the API.

Related pages

• Access control overview — the model behind these rules.
• Global configuration — everything else you can set on a global.
• Global hooks — for logic that transforms data or raises custom errors, beyond allow/deny.