[{"data":1,"prerenderedAt":1400},["ShallowReactive",2],{"navigation_docs":3,"-contribute-decisions-permission-model":587,"-contribute-decisions-permission-model-surround":1397},[4,50,155,441,504],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":49},"Get Started","i-lucide-rocket","\u002Fget-started","1.get-started",[10,15,20,25,30,35,40,45],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fget-started\u002Fintroduction","1.get-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Installation","\u002Fget-started\u002Finstallation","1.get-started\u002F2.installation","i-lucide-download",{"title":21,"path":22,"stem":23,"icon":24},"Project structure","\u002Fget-started\u002Fproject-structure","1.get-started\u002F3.project-structure","i-lucide-folder-tree",{"title":26,"path":27,"stem":28,"icon":29},"Configuration","\u002Fget-started\u002Fconfiguration","1.get-started\u002F4.configuration","i-lucide-settings",{"title":31,"path":32,"stem":33,"icon":34},"Authentication","\u002Fget-started\u002Fauthentication","1.get-started\u002F5.authentication","i-lucide-lock",{"title":36,"path":37,"stem":38,"icon":39},"Adding modules","\u002Fget-started\u002Fadding-modules","1.get-started\u002F6.adding-modules","i-lucide-puzzle",{"title":41,"path":42,"stem":43,"icon":44},"Database","\u002Fget-started\u002Fdatabase","1.get-started\u002F7.database","i-lucide-database",{"title":46,"path":47,"stem":48,"icon":6},"Deployment","\u002Fget-started\u002Fdeployment","1.get-started\u002F8.deployment",false,{"title":51,"icon":52,"path":53,"stem":54,"children":55,"page":49},"Guide","i-lucide-book-open","\u002Fguide","2.guide",[56,90,115,125],{"title":57,"icon":49,"path":58,"stem":59,"children":60,"page":49},"Concepts","\u002Fguide\u002Fconcepts","2.guide\u002F1.concepts",[61,66,71,76,80,85],{"title":62,"path":63,"stem":64,"icon":65},"Architecture","\u002Fguide\u002Fconcepts\u002Farchitecture","2.guide\u002F1.concepts\u002F1.architecture","i-lucide-blocks",{"title":67,"path":68,"stem":69,"icon":70},"Access control","\u002Fguide\u002Fconcepts\u002Fauth-and-scopes","2.guide\u002F1.concepts\u002F2.auth-and-scopes","i-lucide-shield-check",{"title":72,"path":73,"stem":74,"icon":75},"Extension points","\u002Fguide\u002Fconcepts\u002Fextension-points","2.guide\u002F1.concepts\u002F3.extension-points","i-lucide-plug",{"title":77,"path":78,"stem":79,"icon":44},"Database extensions","\u002Fguide\u002Fconcepts\u002Fdatabase-extensions","2.guide\u002F1.concepts\u002F4.database-extensions",{"title":81,"path":82,"stem":83,"icon":84},"Identity","\u002Fguide\u002Fconcepts\u002Fidentity","2.guide\u002F1.concepts\u002F5.identity","i-lucide-fingerprint",{"title":86,"path":87,"stem":88,"icon":89},"Glossary","\u002Fguide\u002Fconcepts\u002Fglossary","2.guide\u002F1.concepts\u002F6.glossary","i-lucide-book-a",{"title":91,"icon":49,"path":92,"stem":93,"children":94,"page":49},"UX patterns","\u002Fguide\u002Fux-patterns","2.guide\u002F2.ux-patterns",[95,100,105,110],{"title":96,"path":97,"stem":98,"icon":99},"Layouts and navigation","\u002Fguide\u002Fux-patterns\u002Flayouts-and-navigation","2.guide\u002F2.ux-patterns\u002F1.layouts-and-navigation","i-lucide-layout-template",{"title":101,"path":102,"stem":103,"icon":104},"Pages","\u002Fguide\u002Fux-patterns\u002Fpages","2.guide\u002F2.ux-patterns\u002F2.pages","i-lucide-table",{"title":106,"path":107,"stem":108,"icon":109},"Forms and actions","\u002Fguide\u002Fux-patterns\u002Fforms-and-actions","2.guide\u002F2.ux-patterns\u002F3.forms-and-actions","i-lucide-square-pen",{"title":111,"path":112,"stem":113,"icon":114},"Text and formatting","\u002Fguide\u002Fux-patterns\u002Ftext-and-formatting","2.guide\u002F2.ux-patterns\u002F4.text-and-formatting","i-lucide-type",{"title":116,"icon":49,"path":117,"stem":118,"children":119,"page":49},"Best practices","\u002Fguide\u002Fbest-practices","2.guide\u002F3.best-practices",[120],{"title":121,"path":122,"stem":123,"icon":124},"HTTP routes","\u002Fguide\u002Fbest-practices\u002Fhttp-routes","2.guide\u002F3.best-practices\u002F1.http-routes","i-lucide-route",{"title":126,"icon":49,"path":127,"stem":128,"children":129,"page":49},"Going further","\u002Fguide\u002Fgoing-further","2.guide\u002F4.going-further",[130,135,140,145,150],{"title":131,"path":132,"stem":133,"icon":134},"Use your own OAuth server","\u002Fguide\u002Fgoing-further\u002Fown-oauth-server","2.guide\u002F4.going-further\u002F1.own-oauth-server","i-lucide-key-round",{"title":136,"path":137,"stem":138,"icon":139},"Create an OAuth application","\u002Fguide\u002Fgoing-further\u002Foauth-application","2.guide\u002F4.going-further\u002F2.oauth-application","i-lucide-app-window",{"title":141,"path":142,"stem":143,"icon":144},"Signing keys","\u002Fguide\u002Fgoing-further\u002Fsigning-keys","2.guide\u002F4.going-further\u002F3.signing-keys","i-lucide-key-square",{"title":146,"path":147,"stem":148,"icon":149},"Stripe setup","\u002Fguide\u002Fgoing-further\u002Fstripe-setup","2.guide\u002F4.going-further\u002F4.stripe-setup","i-lucide-credit-card",{"title":151,"path":152,"stem":153,"icon":154},"Migrate to the permission model","\u002Fguide\u002Fgoing-further\u002Fmigrate-access-control","2.guide\u002F4.going-further\u002F5.migrate-access-control","i-lucide-arrow-right-left",{"title":156,"icon":157,"path":158,"stem":159,"children":160},"Modules","i-lucide-boxes","\u002Fmodules","3.modules",[161,163,244,273,320,375],{"title":156,"path":158,"stem":162},"3.modules\u002Findex",{"title":81,"icon":49,"path":164,"stem":165,"children":166,"page":49},"\u002Fmodules\u002Fidentity","3.modules\u002F1.identity",[167,190,194,198,220,224,240],{"title":168,"path":169,"stem":170,"children":171},"Auth","\u002Fmodules\u002Fidentity\u002Fauth","3.modules\u002F1.identity\u002F1.auth\u002Findex",[172,174,178,182,186],{"title":173,"path":169,"stem":170},"Overview",{"title":175,"path":176,"stem":177},"Server API","\u002Fmodules\u002Fidentity\u002Fauth\u002Fserver","3.modules\u002F1.identity\u002F1.auth\u002F2.server",{"title":179,"path":180,"stem":181},"Reference","\u002Fmodules\u002Fidentity\u002Fauth\u002Freference","3.modules\u002F1.identity\u002F1.auth\u002F3.reference",{"title":183,"path":184,"stem":185},"Client mode","\u002Fmodules\u002Fidentity\u002Fauth\u002Fclient-mode","3.modules\u002F1.identity\u002F1.auth\u002F4.client-mode",{"title":187,"path":188,"stem":189},"OAuth providers","\u002Fmodules\u002Fidentity\u002Fauth\u002Foauth-providers","3.modules\u002F1.identity\u002F1.auth\u002F5.oauth-providers",{"title":191,"path":192,"stem":193},"Users","\u002Fmodules\u002Fidentity\u002Fusers","3.modules\u002F1.identity\u002F2.users",{"title":195,"path":196,"stem":197},"Account","\u002Fmodules\u002Fidentity\u002Faccount","3.modules\u002F1.identity\u002F3.account",{"title":199,"path":200,"stem":201,"children":202},"Authorization","\u002Fmodules\u002Fidentity\u002Fauthorization","3.modules\u002F1.identity\u002F4.authorization\u002Findex",[203,204,208,212,216],{"title":173,"path":200,"stem":201},{"title":205,"path":206,"stem":207},"Roles and requirements","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Froles-and-requirements","3.modules\u002F1.identity\u002F4.authorization\u002F2.roles-and-requirements",{"title":209,"path":210,"stem":211},"Policies","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fpolicies","3.modules\u002F1.identity\u002F4.authorization\u002F3.policies",{"title":213,"path":214,"stem":215},"Client","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fclient","3.modules\u002F1.identity\u002F4.authorization\u002F4.client",{"title":217,"path":218,"stem":219},"Admin","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fadmin","3.modules\u002F1.identity\u002F4.authorization\u002F5.admin",{"title":221,"path":222,"stem":223},"Preferences","\u002Fmodules\u002Fidentity\u002Fpreferences","3.modules\u002F1.identity\u002F5.preferences",{"title":225,"path":226,"stem":227,"children":228},"OAuth Server","\u002Fmodules\u002Fidentity\u002Foauth-server","3.modules\u002F1.identity\u002F6.oauth-server\u002Findex",[229,230,233,237],{"title":173,"path":226,"stem":227},{"title":175,"path":231,"stem":232},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fserver","3.modules\u002F1.identity\u002F6.oauth-server\u002F2.server",{"title":234,"path":235,"stem":236},"Hooks","\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fhooks","3.modules\u002F1.identity\u002F6.oauth-server\u002F3.hooks",{"title":179,"path":238,"stem":239},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Froutes-and-clients","3.modules\u002F1.identity\u002F6.oauth-server\u002F4.routes-and-clients",{"title":241,"path":242,"stem":243},"OAuth Resource","\u002Fmodules\u002Fidentity\u002Foauth-resource","3.modules\u002F1.identity\u002F8.oauth-resource",{"title":245,"icon":49,"path":246,"stem":247,"children":248,"page":49},"Commerce","\u002Fmodules\u002Fcommerce","3.modules\u002F2.commerce",[249,253,257],{"title":250,"path":251,"stem":252},"Stripe","\u002Fmodules\u002Fcommerce\u002Fstripe","3.modules\u002F2.commerce\u002F1.stripe",{"title":254,"path":255,"stem":256},"Payments","\u002Fmodules\u002Fcommerce\u002Fpayments","3.modules\u002F2.commerce\u002F2.payments",{"title":258,"path":259,"stem":260,"children":261},"Subscriptions","\u002Fmodules\u002Fcommerce\u002Fsubscriptions","3.modules\u002F2.commerce\u002F3.subscriptions\u002Findex",[262,263,266,270],{"title":173,"path":259,"stem":260},{"title":175,"path":264,"stem":265},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fserver","3.modules\u002F2.commerce\u002F3.subscriptions\u002F2.server",{"title":267,"path":268,"stem":269},"App","\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fapp","3.modules\u002F2.commerce\u002F3.subscriptions\u002F3.app",{"title":179,"path":271,"stem":272},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Freference","3.modules\u002F2.commerce\u002F3.subscriptions\u002F4.reference",{"title":274,"icon":49,"path":275,"stem":276,"children":277,"page":49},"Features","\u002Fmodules\u002Ffeatures","3.modules\u002F3.features",[278,293,312,316],{"title":279,"path":280,"stem":281,"children":282},"Events","\u002Fmodules\u002Ffeatures\u002Fevents","3.modules\u002F3.features\u002F1.events\u002Findex",[283,284,287,290],{"title":173,"path":280,"stem":281},{"title":175,"path":285,"stem":286},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fserver","3.modules\u002F3.features\u002F1.events\u002F2.server",{"title":267,"path":288,"stem":289},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fapp","3.modules\u002F3.features\u002F1.events\u002F3.app",{"title":179,"path":291,"stem":292},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Freference","3.modules\u002F3.features\u002F1.events\u002F4.reference",{"title":294,"path":295,"stem":296,"children":297},"Forms","\u002Fmodules\u002Ffeatures\u002Fforms","3.modules\u002F3.features\u002F2.forms\u002Findex",[298,299,303,306,309],{"title":173,"path":295,"stem":296},{"title":300,"path":301,"stem":302},"Definition","\u002Fmodules\u002Ffeatures\u002Fforms\u002Fdefinition","3.modules\u002F3.features\u002F2.forms\u002F2.definition",{"title":175,"path":304,"stem":305},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fserver","3.modules\u002F3.features\u002F2.forms\u002F3.server",{"title":267,"path":307,"stem":308},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fapp","3.modules\u002F3.features\u002F2.forms\u002F4.app",{"title":179,"path":310,"stem":311},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Freference","3.modules\u002F3.features\u002F2.forms\u002F5.reference",{"title":313,"path":314,"stem":315},"Cookie Consent","\u002Fmodules\u002Ffeatures\u002Fcookie-consent","3.modules\u002F3.features\u002F3.cookie-consent",{"title":317,"path":318,"stem":319},"MCP","\u002Fmodules\u002Ffeatures\u002Fmcp","3.modules\u002F3.features\u002F4.mcp",{"title":321,"icon":49,"path":322,"stem":323,"children":324,"page":49},"Interface","\u002Fmodules\u002Finterface","3.modules\u002F4.interface",[325,350,353,357,361],{"title":326,"path":327,"stem":328,"children":329},"UI","\u002Fmodules\u002Finterface\u002Fui","3.modules\u002F4.interface\u002F1.ui\u002Findex",[330,331,335,339,343,347],{"title":173,"path":327,"stem":328},{"title":332,"path":333,"stem":334},"Page components","\u002Fmodules\u002Finterface\u002Fui\u002Fpage-components","3.modules\u002F4.interface\u002F1.ui\u002F2.page-components",{"title":336,"path":337,"stem":338},"App shell","\u002Fmodules\u002Finterface\u002Fui\u002Fapp-shell","3.modules\u002F4.interface\u002F1.ui\u002F3.app-shell",{"title":340,"path":341,"stem":342},"Form inputs","\u002Fmodules\u002Finterface\u002Fui\u002Fform-inputs","3.modules\u002F4.interface\u002F1.ui\u002F4.form-inputs",{"title":344,"path":345,"stem":346},"Composables and helpers","\u002Fmodules\u002Finterface\u002Fui\u002Fcomposables","3.modules\u002F4.interface\u002F1.ui\u002F5.composables",{"title":179,"path":348,"stem":349},"\u002Fmodules\u002Finterface\u002Fui\u002Freference","3.modules\u002F4.interface\u002F1.ui\u002F6.reference",{"title":217,"path":351,"stem":352},"\u002Fmodules\u002Finterface\u002Fadmin","3.modules\u002F4.interface\u002F2.admin",{"title":354,"path":355,"stem":356},"Menu","\u002Fmodules\u002Finterface\u002Fmenu","3.modules\u002F4.interface\u002F3.menu",{"title":358,"path":359,"stem":360},"Widget","\u002Fmodules\u002Finterface\u002Fwidget","3.modules\u002F4.interface\u002F4.widget",{"title":362,"path":363,"stem":364,"children":365},"Mobile","\u002Fmodules\u002Finterface\u002Fmobile","3.modules\u002F4.interface\u002F5.mobile\u002Findex",[366,367,371],{"title":173,"path":363,"stem":364},{"title":368,"path":369,"stem":370},"CLI and devices","\u002Fmodules\u002Finterface\u002Fmobile\u002Fcli-and-devices","3.modules\u002F4.interface\u002F5.mobile\u002F2.cli-and-devices",{"title":372,"path":373,"stem":374},"Splash screen","\u002Fmodules\u002Finterface\u002Fmobile\u002Fsplash-screen","3.modules\u002F4.interface\u002F5.mobile\u002F3.splash-screen",{"title":376,"icon":49,"path":377,"stem":378,"children":379,"page":49},"Platform","\u002Fmodules\u002Fplatform","3.modules\u002F5.platform",[380,402,406,423],{"title":381,"path":382,"stem":383,"children":384},"Module Kit","\u002Fmodules\u002Fplatform\u002Fmodule-kit","3.modules\u002F5.platform\u002F1.module-kit\u002Findex",[385,386,390,394,398],{"title":173,"path":382,"stem":383},{"title":387,"path":388,"stem":389},"Server toolkit","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fserver-toolkit","3.modules\u002F5.platform\u002F1.module-kit\u002F2.server-toolkit",{"title":391,"path":392,"stem":393},"Registries and menus","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fregistries-and-menus","3.modules\u002F5.platform\u002F1.module-kit\u002F3.registries-and-menus",{"title":395,"path":396,"stem":397},"Translations","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fi18n","3.modules\u002F5.platform\u002F1.module-kit\u002F4.i18n",{"title":399,"path":400,"stem":401},"Database helpers","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fdatabase","3.modules\u002F5.platform\u002F1.module-kit\u002F5.database",{"title":403,"path":404,"stem":405},"Notify","\u002Fmodules\u002Fplatform\u002Fnotify","3.modules\u002F5.platform\u002F2.notify",{"title":407,"path":408,"stem":409,"children":410},"Email Templates","\u002Fmodules\u002Fplatform\u002Femail-templates","3.modules\u002F5.platform\u002F3.email-templates\u002Findex",[411,412,416,419],{"title":173,"path":408,"stem":409},{"title":413,"path":414,"stem":415},"Email components","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fcomponents","3.modules\u002F5.platform\u002F3.email-templates\u002F2.components",{"title":175,"path":417,"stem":418},"\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fserver","3.modules\u002F5.platform\u002F3.email-templates\u002F3.server",{"title":420,"path":421,"stem":422},"Module emails","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fmodule-emails","3.modules\u002F5.platform\u002F3.email-templates\u002F4.module-emails",{"title":424,"path":425,"stem":426,"children":427},"Base Layer","\u002Fmodules\u002Fplatform\u002Fbase-layer","3.modules\u002F5.platform\u002F4.base-layer\u002Findex",[428,429,433,437],{"title":173,"path":425,"stem":426},{"title":430,"path":431,"stem":432},"Content collections","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcontent-collections","3.modules\u002F5.platform\u002F4.base-layer\u002F2.content-collections",{"title":434,"path":435,"stem":436},"Layouts and routing","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Flayouts-and-routing","3.modules\u002F5.platform\u002F4.base-layer\u002F3.layouts-and-routing",{"title":438,"path":439,"stem":440},"Composables and utils","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcomposables-and-utils","3.modules\u002F5.platform\u002F4.base-layer\u002F4.composables-and-utils",{"title":442,"icon":443,"path":444,"stem":445,"children":446,"page":49},"Examples","i-lucide-code-xml","\u002Fexamples","4.examples",[447,466,476],{"title":448,"icon":49,"path":449,"stem":450,"children":451,"page":49},"Starters","\u002Fexamples\u002Fstarters","4.examples\u002F1.starters",[452,456,461],{"title":453,"path":454,"stem":455,"icon":6},"Workspace starter","\u002Fexamples\u002Fstarters\u002Fworkspace","4.examples\u002F1.starters\u002F1.workspace",{"title":457,"path":458,"stem":459,"icon":460},"Mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile","4.examples\u002F1.starters\u002F2.mobile","i-lucide-smartphone",{"title":462,"path":463,"stem":464,"icon":465},"Standalone mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile-standalone","4.examples\u002F1.starters\u002F3.mobile-standalone","i-lucide-tablet-smartphone",{"title":467,"icon":49,"path":468,"stem":469,"children":470,"page":49},"Apps","\u002Fexamples\u002Fapps","4.examples\u002F2.apps",[471],{"title":472,"path":473,"stem":474,"icon":475},"Frigear website app","\u002Fexamples\u002Fapps\u002Ffrigear-nu-website","4.examples\u002F2.apps\u002F1.frigear-nu-website","i-lucide-layout-dashboard",{"title":477,"icon":49,"path":478,"stem":479,"children":480,"page":49},"Tasks","\u002Fexamples\u002Ftasks","4.examples\u002F3.tasks",[481,485,489,494,499],{"title":482,"path":483,"stem":484,"icon":70},"Protect a route","\u002Fexamples\u002Ftasks\u002Fprotect-a-route","4.examples\u002F3.tasks\u002F1.protect-a-route",{"title":486,"path":487,"stem":488,"icon":475},"Add an admin page","\u002Fexamples\u002Ftasks\u002Fadd-an-admin-page","4.examples\u002F3.tasks\u002F2.add-an-admin-page",{"title":490,"path":491,"stem":492,"icon":493},"Sell event tickets","\u002Fexamples\u002Ftasks\u002Fsell-event-tickets","4.examples\u002F3.tasks\u002F3.sell-event-tickets","i-lucide-ticket",{"title":495,"path":496,"stem":497,"icon":498},"Build a form","\u002Fexamples\u002Ftasks\u002Fbuild-a-form","4.examples\u002F3.tasks\u002F4.build-a-form","i-lucide-clipboard-list",{"title":500,"path":501,"stem":502,"icon":503},"Send an email","\u002Fexamples\u002Ftasks\u002Fsend-an-email","4.examples\u002F3.tasks\u002F5.send-an-email","i-lucide-mail",{"title":505,"icon":506,"path":507,"stem":508,"children":509,"page":49},"Contribute","i-lucide-git-pull-request","\u002Fcontribute","5.contribute",[510,513,518,544,549,552,556,571],{"title":173,"path":511,"stem":512,"icon":506},"\u002Fcontribute\u002Foverview","5.contribute\u002F1.overview",{"title":514,"path":515,"stem":516,"icon":517},"Local development","\u002Fcontribute\u002Flocal-development","5.contribute\u002F2.local-development","i-lucide-terminal",{"title":519,"icon":49,"path":520,"stem":521,"children":522,"page":49},"Writing a module","\u002Fcontribute\u002Fwriting-a-module","5.contribute\u002F3.writing-a-module",[523,527,532,536,541],{"title":524,"path":525,"stem":526,"icon":39},"Scaffold a module","\u002Fcontribute\u002Fwriting-a-module\u002Fscaffold","5.contribute\u002F3.writing-a-module\u002F1.scaffold",{"title":528,"path":529,"stem":530,"icon":531},"Setup checklist","\u002Fcontribute\u002Fwriting-a-module\u002Fsetup-checklist","5.contribute\u002F3.writing-a-module\u002F2.setup-checklist","i-lucide-list-checks",{"title":533,"path":534,"stem":535,"icon":44},"Database tables","\u002Fcontribute\u002Fwriting-a-module\u002Fdatabase-tables","5.contribute\u002F3.writing-a-module\u002F3.database-tables",{"title":537,"path":538,"stem":539,"icon":540},"Testing","\u002Fcontribute\u002Fwriting-a-module\u002Ftesting","5.contribute\u002F3.writing-a-module\u002F4.testing","i-lucide-flask-conical",{"title":67,"path":542,"stem":543,"icon":70},"\u002Fcontribute\u002Fwriting-a-module\u002Faccess-control","5.contribute\u002F3.writing-a-module\u002F5.access-control",{"title":545,"path":546,"stem":547,"icon":548},"Publishing","\u002Fcontribute\u002Fpublishing","5.contribute\u002F4.publishing","i-lucide-package-check",{"title":448,"path":550,"stem":551,"icon":6},"\u002Fcontribute\u002Fstarters","5.contribute\u002F5.starters",{"title":553,"path":554,"stem":555,"icon":52},"Documentation","\u002Fcontribute\u002Fdocumentation","5.contribute\u002F6.documentation",{"title":557,"icon":49,"path":558,"stem":559,"children":560,"page":49},"Tooling","\u002Fcontribute\u002Ftooling","5.contribute\u002F7.tooling",[561,566],{"title":562,"path":563,"stem":564,"icon":565},"CLI","\u002Fcontribute\u002Ftooling\u002Fcli","5.contribute\u002F7.tooling\u002F1.cli","i-lucide-square-terminal",{"title":567,"path":568,"stem":569,"icon":570},"ESLint config","\u002Fcontribute\u002Ftooling\u002Feslint-config","5.contribute\u002F7.tooling\u002F2.eslint-config","i-lucide-spell-check",{"title":572,"icon":49,"path":573,"stem":574,"children":575},"Decisions","\u002Fcontribute\u002Fdecisions","5.contribute\u002F8.decisions\u002Findex",[576,578,583],{"title":572,"path":573,"stem":574,"icon":577},"i-lucide-scale",{"title":579,"path":580,"stem":581,"icon":582},"Session lifetimes per OAuth client","\u002Fcontribute\u002Fdecisions\u002Foauth-token-lifetimes","5.contribute\u002F8.decisions\u002F1.oauth-token-lifetimes","i-lucide-timer",{"title":584,"path":585,"stem":586,"icon":70},"One permission model","\u002Fcontribute\u002Fdecisions\u002Fpermission-model","5.contribute\u002F8.decisions\u002F2.permission-model",{"id":588,"title":584,"body":589,"description":1390,"extension":1391,"links":1392,"meta":1393,"navigation":1394,"path":585,"seo":1395,"stem":586,"__hash__":1396},"docs\u002F5.contribute\u002F8.decisions\u002F2.permission-model.md",{"type":590,"value":591,"toc":1375},"minimark",[592,660,665,668,712,735,739,750,755,873,910,914,924,1012,1019,1023,1153,1157,1192,1203,1207,1285,1289,1334,1338],[593,594,595,599,600,603,604,608,609,612,613,616,617,616,620,616,623,616,626,616,629,632,633,616,636,616,639,616,642,616,645,616,648,651,652,655,656,659],"p",{},[596,597,598],"strong",{},"Status:"," accepted (2026-11-12), being implemented. ",[596,601,602],{},"Scope:"," ",[605,606,607],"code",{},"@frigear-nu\u002Fauth"," (the engine), ",[605,610,611],{},"@frigear-nu\u002Fauthorization","\n(roles), every module that checks access (",[605,614,615],{},"users",", ",[605,618,619],{},"events",[605,621,622],{},"forms",[605,624,625],{},"payments",[605,627,628],{},"subscriptions",[605,630,631],{},"mcp",",\n",[605,634,635],{},"oauth-server",[605,637,638],{},"oauth-resource",[605,640,641],{},"admin",[605,643,644],{},"menu",[605,646,647],{},"widget",[605,649,650],{},"account","), ",[605,653,654],{},"apps\u002Fwebsite"," and the docs. The pure core\nlives in ",[605,657,658],{},"packages\u002Fauth\u002Fsrc\u002Fruntime\u002Futils\u002Fpermissions.ts",".",[661,662,664],"h2",{"id":663},"context","Context",[593,666,667],{},"Authorization grew three systems that disagree with each other:",[669,670,671,681,698],"ul",{},[672,673,674,603,677,680],"li",{},[596,675,676],{},"Abilities:",[605,678,679],{},"defineAbility"," functions that only see the plain user.",[672,682,683,686,687,616,690,693,694,697],{},[596,684,685],{},"Role-name checks:"," route rules, ",[605,688,689],{},"admin.settings.roles",[605,691,692],{},"meta.roles"," and account documents compare ",[605,695,696],{},"user.role","\nwith a fixed name, with no hierarchy.",[672,699,700,703,704,707,708,711],{},[596,701,702],{},"RBAC"," behind ",[605,705,706],{},"rbac: true",": permissions registered with ",[605,709,710],{},"addAuthScope",", so \"scope\" and \"permission\" are one string\nunder two names.",[593,713,714,715,718,719,722,723,726,727,730,731,734],{},"On top of that, each module adds its own ",[605,716,717],{},"\u003Cmodule>:authorize"," hook and its own ",[605,720,721],{},"defineStaffGuard"," \u002F ",[605,724,725],{},"definePolicyGate","\n\u002F ",[605,728,729],{},"defineStaffScopes",". In practice that gives three different defaults without RBAC (one of them \"allow everything\"),\na client ",[605,732,733],{},"can()"," that disagrees with the server, allowlisted staff who cannot mint tokens, OAuth scopes that are\ndropped without a word, and no way for a mobile app or a resource server to see what a token may do.",[661,736,738],{"id":737},"decision","Decision",[593,740,741,742,745,746,749],{},"A Laravel-style model (gates, policies, ",[605,743,744],{},"Gate::before",") keyed on ",[605,747,748],{},"resource:action"," strings, with one meaning per word.",[751,752,754],"h3",{"id":753},"vocabulary","Vocabulary",[756,757,758,771],"table",{},[759,760,761],"thead",{},[762,763,764,768],"tr",{},[765,766,767],"th",{},"Term",[765,769,770],{},"Meaning",[772,773,774,791,818,836,853],"tbody",{},[762,775,776,782],{},[777,778,779],"td",{},[596,780,781],{},"Permission",[777,783,784,786,787,790],{},[605,785,748],{},", registered by a module or the host (",[605,788,789],{},"addPermission","). The only thing code checks.",[762,792,793,798],{},[777,794,795],{},[596,796,797],{},"Role",[777,799,800,801,804,805,616,808,616,811,616,814,817],{},"A named bundle in ",[605,802,803],{},"authorization.roles",": ",[605,806,807],{},"grant",[605,809,810],{},"inherit",[605,812,813],{},"requirements",[605,815,816],{},"auto",". A user holds several.",[762,819,820,825],{},[777,821,822],{},[596,823,824],{},"Scope",[777,826,827,828,831,832,835],{},"What a delegated credential (API token, OAuth token) may do: a permission, a wildcard, or a named scope that expands to permissions (",[605,829,830],{},"tickets",") or to none (",[605,833,834],{},"openid",").",[762,837,838,843],{},[777,839,840],{},[596,841,842],{},"Policy",[777,844,845,846,616,849,852],{},"Code that refines one permission against a record (",[605,847,848],{},"definePolicy",[605,850,851],{},"defineSharedPolicy","). It can deny, never grant.",[762,854,855,860],{},[777,856,857],{},[596,858,859],{},"Before hook",[777,861,862,865,866,869,870,659],{},[605,863,864],{},"authorization:before",", the single host override. Listeners call ",[605,867,868],{},"allow()"," or ",[605,871,872],{},"deny()",[593,874,875,878,879,882,883,886,887,890,891,894,895,898,899,901,902,905,906,909],{},[605,876,877],{},"*"," and ",[605,880,881],{},"resource:*"," never cover a ",[596,884,885],{},"sensitive"," permission (",[605,888,889],{},":pii"," by default): those are granted by name. An ",[596,892,893],{},"alias","\n(an old name a permission was split from) expands only on the held side, so a token that holds ",[605,896,897],{},"events:manage"," keeps\nworking while code that checks ",[605,900,897],{}," fails. Ability, staff guard, policy gate, ceiling, ",[605,903,904],{},"aggregateTo"," and\n",[605,907,908],{},"rbac"," leave the public API.",[751,911,913],{"id":912},"evaluation","Evaluation",[593,915,916,919,920,923],{},[605,917,918],{},"authorize(event, permission, record?)"," resolves the inputs and hands them to the pure ",[605,921,922],{},"decide",":",[925,926,927,934,940,950,956,967,992,1009],"ol",{},[672,928,929,930,933],{},"Unknown permission: 403 ",[605,931,932],{},"forbidden"," (and an error in development).",[672,935,936,937,659],{},"No principal: 401 ",[605,938,939],{},"unauthorized",[672,941,942,943,946,947,659],{},"A ",[605,944,945],{},"sessionOnly"," permission on a bearer credential: 403 ",[605,948,949],{},"session_required",[672,951,952,953,659],{},"A bearer whose permissions, frozen when it was issued, don't cover the permission: 403 ",[605,954,955],{},"insufficient_scope",[672,957,958,960,961,963,964,966],{},[605,959,864],{},": any ",[605,962,872],{}," or a listener that throws denies; otherwise any ",[605,965,868],{}," allows and skips 6-7.",[672,968,969,970,973,974,976,977,980,981,983,984,987,988,991],{},"The user's roles: assigned ∪ ",[605,971,972],{},"defaultRoles"," ∪ ",[605,975,816],{}," roles ∪ ",[605,978,979],{},"authorization:roles",", minus roles whose\nrequirements fail, closed over ",[605,982,810],{},", plus ",[605,985,986],{},"implicit"," permissions. A token from a foreign issuer uses its own\n",[605,989,990],{},"permissions"," claim instead.",[672,993,994,995,804,998,1001,1002,878,1005,1008],{},"Policies, only for a check with a record unless ",[605,996,997],{},"withoutRecord",[605,999,1000],{},"false"," or a throw denies, ",[605,1003,1004],{},"true",[605,1006,1007],{},"undefined","\nkeep the result. Module policies run before host ones.",[672,1010,1011],{},"The result.",[593,1013,1014,1015,1018],{},"Steps 3 and 4 always win, so neither the before hook nor a policy can widen a credential. Policies refine and never flip\na denial into a grant: an owner rule is ",[605,1016,1017],{},"record.ownerId === user.id || undefined"," on top of a role grant.",[751,1020,1022],{"id":1021},"fail-closed","Fail closed",[756,1024,1025,1035],{},[759,1026,1027],{},[762,1028,1029,1032],{},[765,1030,1031],{},"Situation",[765,1033,1034],{},"Result",[772,1036,1037,1052,1060,1074,1084,1094,1101,1109,1125,1139],{},[762,1038,1039,1042],{},[777,1040,1041],{},"Permission not registered",[777,1043,1044,1045,1047,1048,1051],{},"403 ",[605,1046,932],{},", also for admins and when ",[605,1049,1050],{},"before"," allows",[762,1053,1054,1057],{},[777,1055,1056],{},"Wildcard and a sensitive permission",[777,1058,1059],{},"Not covered; sensitive permissions are granted by name",[762,1061,1062,1068],{},[777,1063,1064,1065,1067],{},"Bearer without a frozen ",[605,1066,990],{}," set",[777,1069,1070,1071,1073],{},"Holds nothing (403 ",[605,1072,955],{},")",[762,1075,1076,1081],{},[777,1077,942,1078,1080],{},[605,1079,1050],{}," listener throws",[777,1082,1083],{},"Denies",[762,1085,1086,1089],{},[777,1087,1088],{},"A role requirement throws",[777,1090,1091,1092,1073],{},"The role does not count (nor does it through ",[605,1093,810],{},[762,1095,1096,1099],{},[777,1097,1098],{},"A policy throws, or a shared policy returns a promise",[777,1100,1083],{},[762,1102,1103,1106],{},[777,1104,1105],{},"Role in the data but not in config",[777,1107,1108],{},"Ignored at runtime, listed in a warning in the server log",[762,1110,1111,1116],{},[777,1112,1113,1115],{},[605,1114,611],{}," not installed",[777,1117,1118,1119,1121,1122,1124],{},"Only ",[605,1120,986],{}," permissions and ",[605,1123,1050],{},"; route rules are still enforced by auth",[762,1126,1127,1133],{},[777,1128,1129,1130],{},"Unknown OAuth scope at ",[605,1131,1132],{},"\u002Fauthorize",[777,1134,1135,1138],{},[605,1136,1137],{},"invalid_scope"," (re-filtered silently on refresh)",[762,1140,1141,1150],{},[777,1142,1143,1144,1146,1147,1149],{},"A grant, wildcard, requirement or ",[605,1145,810],{}," that names nothing, an inherit cycle, an ",[605,1148,816],{}," default role",[777,1151,1152],{},"Build error",[751,1154,1156],{"id":1155},"roles-and-scopes","Roles and scopes",[593,1158,1159,1160,1162,1163,1166,1167,1170,1171,1174,1175,616,1178,616,1181,1184,1185,616,1188,1191],{},"Roles come from config only (",[605,1161,803],{}," plus module defaults with ",[605,1164,1165],{},"addRole","; the host wins per key) and are\nstored per user in ",[605,1168,1169],{},"authorization_user_roles"," with a ",[605,1172,1173],{},"source"," (",[605,1176,1177],{},"manual",[605,1179,1180],{},"sso",[605,1182,1183],{},"migrated","), so single sign-on can\nreplace its own rows without touching manually assigned ones. Auth reaches roles only through a role provider\n(",[605,1186,1187],{},"getAssignedRoles",[605,1189,1190],{},"setRoles","), which authorization supplies and which assigns nothing without it.",[593,1193,1194,1195,1198,1199,1202],{},"OAuth scopes stay scopes. A scope is grantable when every permission it expands to passes steps 5-6, when it lies within\nthe union of the user's ",[605,1196,1197],{},"oauthServer.settings.roleScopes"," (unset: no cap), and, for wildcards, only for clients with\n",[605,1200,1201],{},"wildcardScopes: true",". Its expansion is frozen into the token at issue, intersected with the user's permissions, so\nstep 4 never queries the scope tables.",[661,1204,1206],{"id":1205},"consequences","Consequences",[669,1208,1209,1244,1263,1279],{},[672,1210,1211,1214,1215,1218,1219,616,1222,632,1225,616,1227,616,1230,1233,1234,1237,1238,1240,1241,1243],{},[596,1212,1213],{},"Breaking, no shims:"," the per-module ",[605,1216,1217],{},"*:authorize"," hooks, ",[605,1220,1221],{},"auth:user-permissions",[605,1223,1224],{},"auth:scope-available",[605,1226,710],{},[605,1228,1229],{},"addAuthRole",[605,1231,1232],{},"requireAuth","'s ",[605,1235,1236],{},"scopes"," option and the ",[605,1239,908],{}," flag are removed in one coordinated\nrelease (",[605,1242,615],{}," 3.0, a breaking minor elsewhere). A migration guide maps each to its replacement, and a\ndevelopment-only plugin warns about listeners on removed hook names.",[672,1245,1246,603,1249,1252,1253,1174,1255,1258,1259,1262],{},[596,1247,1248],{},"Data:",[605,1250,1251],{},"users.role"," is copied once into ",[605,1254,1169],{},[605,1256,1257],{},"source = 'migrated'",") by an idempotent task\nthat runs once on the first request after the upgrade (a marker in ",[605,1260,1261],{},"authorization_meta","), never read again, and dropped one release later.",[672,1264,1265,603,1268,1271,1272,1275,1276,1278],{},[596,1266,1267],{},"Clients:",[605,1269,1270],{},"GET \u002Fapi\u002Fauth\u002Fme\u002Faccess"," returns ",[605,1273,1274],{},"{ kind, scopes, permissions, roles? }",", so the client's ",[605,1277,733],{},", a\nmobile app and a resource server see the same answer as the server; shared policies run on both sides.",[672,1280,1281,1284],{},[596,1282,1283],{},"Cost:"," roles, permission sets and decisions without a record are cached per request; policy results never are.",[661,1286,1288],{"id":1287},"alternatives-considered","Alternatives considered",[669,1290,1291,1304,1310,1325],{},[672,1292,1293,1296,1297,1300,1301,1303],{},[596,1294,1295],{},"One role per user."," Simple, but it forces combinatorial roles (",[605,1298,1299],{},"eventmanager-and-member",") and cannot express a\nderived role such as \"has a subscription\". Rejected for several roles per user plus ",[605,1302,816],{}," roles.",[672,1305,1306,1309],{},[596,1307,1308],{},"Roles editable in the database."," Flexible for admins, but a typo becomes a privilege escalation that no build\ncatches, and roles would differ between environments. Rejected: roles come from config and are compiled at build\ntime; only the assignment of roles to users lives in the database.",[672,1311,1312,1315,1316,616,1318,1321,1322,1324],{},[596,1313,1314],{},"Merging auth and authorization into one package."," Fewer moving parts, but every app that only needs sign-in would\ncarry role tables and admin pages. Rejected: the engine (",[605,1317,922],{},[605,1319,1320],{},"authorize",", the hook) is in auth and works with\n",[605,1323,986],{}," permissions alone; roles are a provider that authorization plugs in.",[672,1326,1327,1333],{},[596,1328,1329,1330,1332],{},"Keeping the ",[605,1331,908],{}," flag."," A switch between two models doubles every code path and test, and one side of it was\n\"allow everything\". Rejected: there is one model and it fails closed.",[661,1335,1337],{"id":1336},"tests","Tests",[669,1339,1340,1343,1358,1365],{},[672,1341,1342],{},"The matcher: wildcards, sensitive permissions never matched by a wildcard, aliases on the held side only, unknown\npermissions.",[672,1344,1345,1346,1348,1349,1351,1352,1354,1355,1357],{},"The ",[605,1347,922],{}," table: session, user token and OAuth token × ",[605,1350,945],{}," × several ",[605,1353,1050],{}," listeners (allow, deny,\nthrow) × roles, requirements and ",[605,1356,816],{}," × policies (true, false, undefined, throw, without a record).",[672,1359,1360,1361,1364],{},"Role compile errors and the inheritance closure; scope grantability with the ",[605,1362,1363],{},"roleScopes"," union and wildcards.",[672,1366,1367,1368,1371,1372,1374],{},"End to end, on existing fixtures: ",[605,1369,1370],{},"me\u002Faccess",", role assignment and escalation, the role migration, frozen token\npermissions, ",[605,1373,1137],{},", introspection and menu filtering after sign-in and sign-out.",{"title":1376,"searchDepth":1377,"depth":1377,"links":1378},"",2,[1379,1380,1387,1388,1389],{"id":663,"depth":1377,"text":664},{"id":737,"depth":1377,"text":738,"children":1381},[1382,1384,1385,1386],{"id":753,"depth":1383,"text":754},3,{"id":912,"depth":1383,"text":913},{"id":1021,"depth":1383,"text":1022},{"id":1155,"depth":1383,"text":1156},{"id":1205,"depth":1377,"text":1206},{"id":1287,"depth":1377,"text":1288},{"id":1336,"depth":1377,"text":1337},"Why abilities, role-name checks, RBAC scopes and per-module authorize hooks become one model of permissions, roles, scopes and policies, how a check is evaluated, and what fails closed.","md",null,{},{"icon":70},{"title":584,"description":1390},"nWE9X9xtUielZsCQOfnmei_Me8xJAU3z1uhqUKI9nMI",[1398,1392],{"title":579,"path":580,"stem":581,"description":1399,"icon":582,"children":-1},"Why refresh-token lifetimes move from one global setting to a policy per application, how a first-party native app stays signed in for months, and what users and admins get to end those sessions.",1794503153811]