Remove unsupported $eqi from RBAC condition operators

[butcherZ]

Description

The RBAC custom-conditions guide listed $eqi as a supported operator for condition query objects, but it is not supported.

RBAC condition query objects are matched in-memory by sift.js through a restricted operator whitelist defined in packages/core/permissions/src/engine/abilities/casl-ability.ts:

const allowedOperations = [
  '$or', '$and', '$eq', '$ne', '$in', '$nin',
  '$lt', '$lte', '$gt', '$gte', '$exists', '$elemMatch',
] as const;

const operations = pick(allowedOperations, sift);
const conditionsMatcher = (conditions) => sift.createQueryTester(conditions, { operations });

$eqi is absent from that list. Any operator outside the whitelist ($eqi, $contains, $startsWith, $null, …) causes sift to throw Unsupported operation: <op> when the condition is evaluated on a create/update/delete/publish, so a "read-valid" condition can hard-fail write operations.

This PR:

• Removes $eqi from the supported-operators list so it matches the code whitelist.
• Adds a caution clarifying that the list is exhaustive and that filter operators available in the REST/Query Engine APIs (e.g. $eqi, $contains, $startsWith, $null) are not usable in RBAC condition query objects and will throw when evaluated.

Related issue(s)/PR(s)

EE-115

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
documentation	Ready	Preview	Aug 24, 2026 2:22pm

[pwizla]

Thanks, Ziyi! I'm merging it 🚀