[{"data":1,"prerenderedAt":2056},["ShallowReactive",2],{"navigation_docs":3,"-examples-tasks-protect-a-route":587,"-examples-tasks-protect-a-route-surround":2051},[4,50,155,441,504],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":49},"Get Started","i-lucide-rocket","\u002Fget-started","1.get-started",[10,15,20,25,30,35,40,45],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fget-started\u002Fintroduction","1.get-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Installation","\u002Fget-started\u002Finstallation","1.get-started\u002F2.installation","i-lucide-download",{"title":21,"path":22,"stem":23,"icon":24},"Project structure","\u002Fget-started\u002Fproject-structure","1.get-started\u002F3.project-structure","i-lucide-folder-tree",{"title":26,"path":27,"stem":28,"icon":29},"Configuration","\u002Fget-started\u002Fconfiguration","1.get-started\u002F4.configuration","i-lucide-settings",{"title":31,"path":32,"stem":33,"icon":34},"Authentication","\u002Fget-started\u002Fauthentication","1.get-started\u002F5.authentication","i-lucide-lock",{"title":36,"path":37,"stem":38,"icon":39},"Adding modules","\u002Fget-started\u002Fadding-modules","1.get-started\u002F6.adding-modules","i-lucide-puzzle",{"title":41,"path":42,"stem":43,"icon":44},"Database","\u002Fget-started\u002Fdatabase","1.get-started\u002F7.database","i-lucide-database",{"title":46,"path":47,"stem":48,"icon":6},"Deployment","\u002Fget-started\u002Fdeployment","1.get-started\u002F8.deployment",false,{"title":51,"icon":52,"path":53,"stem":54,"children":55,"page":49},"Guide","i-lucide-book-open","\u002Fguide","2.guide",[56,90,115,125],{"title":57,"icon":49,"path":58,"stem":59,"children":60,"page":49},"Concepts","\u002Fguide\u002Fconcepts","2.guide\u002F1.concepts",[61,66,71,76,80,85],{"title":62,"path":63,"stem":64,"icon":65},"Architecture","\u002Fguide\u002Fconcepts\u002Farchitecture","2.guide\u002F1.concepts\u002F1.architecture","i-lucide-blocks",{"title":67,"path":68,"stem":69,"icon":70},"Access control","\u002Fguide\u002Fconcepts\u002Fauth-and-scopes","2.guide\u002F1.concepts\u002F2.auth-and-scopes","i-lucide-shield-check",{"title":72,"path":73,"stem":74,"icon":75},"Extension points","\u002Fguide\u002Fconcepts\u002Fextension-points","2.guide\u002F1.concepts\u002F3.extension-points","i-lucide-plug",{"title":77,"path":78,"stem":79,"icon":44},"Database extensions","\u002Fguide\u002Fconcepts\u002Fdatabase-extensions","2.guide\u002F1.concepts\u002F4.database-extensions",{"title":81,"path":82,"stem":83,"icon":84},"Identity","\u002Fguide\u002Fconcepts\u002Fidentity","2.guide\u002F1.concepts\u002F5.identity","i-lucide-fingerprint",{"title":86,"path":87,"stem":88,"icon":89},"Glossary","\u002Fguide\u002Fconcepts\u002Fglossary","2.guide\u002F1.concepts\u002F6.glossary","i-lucide-book-a",{"title":91,"icon":49,"path":92,"stem":93,"children":94,"page":49},"UX patterns","\u002Fguide\u002Fux-patterns","2.guide\u002F2.ux-patterns",[95,100,105,110],{"title":96,"path":97,"stem":98,"icon":99},"Layouts and navigation","\u002Fguide\u002Fux-patterns\u002Flayouts-and-navigation","2.guide\u002F2.ux-patterns\u002F1.layouts-and-navigation","i-lucide-layout-template",{"title":101,"path":102,"stem":103,"icon":104},"Pages","\u002Fguide\u002Fux-patterns\u002Fpages","2.guide\u002F2.ux-patterns\u002F2.pages","i-lucide-table",{"title":106,"path":107,"stem":108,"icon":109},"Forms and actions","\u002Fguide\u002Fux-patterns\u002Fforms-and-actions","2.guide\u002F2.ux-patterns\u002F3.forms-and-actions","i-lucide-square-pen",{"title":111,"path":112,"stem":113,"icon":114},"Text and formatting","\u002Fguide\u002Fux-patterns\u002Ftext-and-formatting","2.guide\u002F2.ux-patterns\u002F4.text-and-formatting","i-lucide-type",{"title":116,"icon":49,"path":117,"stem":118,"children":119,"page":49},"Best practices","\u002Fguide\u002Fbest-practices","2.guide\u002F3.best-practices",[120],{"title":121,"path":122,"stem":123,"icon":124},"HTTP routes","\u002Fguide\u002Fbest-practices\u002Fhttp-routes","2.guide\u002F3.best-practices\u002F1.http-routes","i-lucide-route",{"title":126,"icon":49,"path":127,"stem":128,"children":129,"page":49},"Going further","\u002Fguide\u002Fgoing-further","2.guide\u002F4.going-further",[130,135,140,145,150],{"title":131,"path":132,"stem":133,"icon":134},"Use your own OAuth server","\u002Fguide\u002Fgoing-further\u002Fown-oauth-server","2.guide\u002F4.going-further\u002F1.own-oauth-server","i-lucide-key-round",{"title":136,"path":137,"stem":138,"icon":139},"Create an OAuth application","\u002Fguide\u002Fgoing-further\u002Foauth-application","2.guide\u002F4.going-further\u002F2.oauth-application","i-lucide-app-window",{"title":141,"path":142,"stem":143,"icon":144},"Signing keys","\u002Fguide\u002Fgoing-further\u002Fsigning-keys","2.guide\u002F4.going-further\u002F3.signing-keys","i-lucide-key-square",{"title":146,"path":147,"stem":148,"icon":149},"Stripe setup","\u002Fguide\u002Fgoing-further\u002Fstripe-setup","2.guide\u002F4.going-further\u002F4.stripe-setup","i-lucide-credit-card",{"title":151,"path":152,"stem":153,"icon":154},"Migrate to the permission model","\u002Fguide\u002Fgoing-further\u002Fmigrate-access-control","2.guide\u002F4.going-further\u002F5.migrate-access-control","i-lucide-arrow-right-left",{"title":156,"icon":157,"path":158,"stem":159,"children":160},"Modules","i-lucide-boxes","\u002Fmodules","3.modules",[161,163,244,273,320,375],{"title":156,"path":158,"stem":162},"3.modules\u002Findex",{"title":81,"icon":49,"path":164,"stem":165,"children":166,"page":49},"\u002Fmodules\u002Fidentity","3.modules\u002F1.identity",[167,190,194,198,220,224,240],{"title":168,"path":169,"stem":170,"children":171},"Auth","\u002Fmodules\u002Fidentity\u002Fauth","3.modules\u002F1.identity\u002F1.auth\u002Findex",[172,174,178,182,186],{"title":173,"path":169,"stem":170},"Overview",{"title":175,"path":176,"stem":177},"Server API","\u002Fmodules\u002Fidentity\u002Fauth\u002Fserver","3.modules\u002F1.identity\u002F1.auth\u002F2.server",{"title":179,"path":180,"stem":181},"Reference","\u002Fmodules\u002Fidentity\u002Fauth\u002Freference","3.modules\u002F1.identity\u002F1.auth\u002F3.reference",{"title":183,"path":184,"stem":185},"Client mode","\u002Fmodules\u002Fidentity\u002Fauth\u002Fclient-mode","3.modules\u002F1.identity\u002F1.auth\u002F4.client-mode",{"title":187,"path":188,"stem":189},"OAuth providers","\u002Fmodules\u002Fidentity\u002Fauth\u002Foauth-providers","3.modules\u002F1.identity\u002F1.auth\u002F5.oauth-providers",{"title":191,"path":192,"stem":193},"Users","\u002Fmodules\u002Fidentity\u002Fusers","3.modules\u002F1.identity\u002F2.users",{"title":195,"path":196,"stem":197},"Account","\u002Fmodules\u002Fidentity\u002Faccount","3.modules\u002F1.identity\u002F3.account",{"title":199,"path":200,"stem":201,"children":202},"Authorization","\u002Fmodules\u002Fidentity\u002Fauthorization","3.modules\u002F1.identity\u002F4.authorization\u002Findex",[203,204,208,212,216],{"title":173,"path":200,"stem":201},{"title":205,"path":206,"stem":207},"Roles and requirements","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Froles-and-requirements","3.modules\u002F1.identity\u002F4.authorization\u002F2.roles-and-requirements",{"title":209,"path":210,"stem":211},"Policies","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fpolicies","3.modules\u002F1.identity\u002F4.authorization\u002F3.policies",{"title":213,"path":214,"stem":215},"Client","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fclient","3.modules\u002F1.identity\u002F4.authorization\u002F4.client",{"title":217,"path":218,"stem":219},"Admin","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fadmin","3.modules\u002F1.identity\u002F4.authorization\u002F5.admin",{"title":221,"path":222,"stem":223},"Preferences","\u002Fmodules\u002Fidentity\u002Fpreferences","3.modules\u002F1.identity\u002F5.preferences",{"title":225,"path":226,"stem":227,"children":228},"OAuth Server","\u002Fmodules\u002Fidentity\u002Foauth-server","3.modules\u002F1.identity\u002F6.oauth-server\u002Findex",[229,230,233,237],{"title":173,"path":226,"stem":227},{"title":175,"path":231,"stem":232},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fserver","3.modules\u002F1.identity\u002F6.oauth-server\u002F2.server",{"title":234,"path":235,"stem":236},"Hooks","\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fhooks","3.modules\u002F1.identity\u002F6.oauth-server\u002F3.hooks",{"title":179,"path":238,"stem":239},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Froutes-and-clients","3.modules\u002F1.identity\u002F6.oauth-server\u002F4.routes-and-clients",{"title":241,"path":242,"stem":243},"OAuth Resource","\u002Fmodules\u002Fidentity\u002Foauth-resource","3.modules\u002F1.identity\u002F8.oauth-resource",{"title":245,"icon":49,"path":246,"stem":247,"children":248,"page":49},"Commerce","\u002Fmodules\u002Fcommerce","3.modules\u002F2.commerce",[249,253,257],{"title":250,"path":251,"stem":252},"Stripe","\u002Fmodules\u002Fcommerce\u002Fstripe","3.modules\u002F2.commerce\u002F1.stripe",{"title":254,"path":255,"stem":256},"Payments","\u002Fmodules\u002Fcommerce\u002Fpayments","3.modules\u002F2.commerce\u002F2.payments",{"title":258,"path":259,"stem":260,"children":261},"Subscriptions","\u002Fmodules\u002Fcommerce\u002Fsubscriptions","3.modules\u002F2.commerce\u002F3.subscriptions\u002Findex",[262,263,266,270],{"title":173,"path":259,"stem":260},{"title":175,"path":264,"stem":265},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fserver","3.modules\u002F2.commerce\u002F3.subscriptions\u002F2.server",{"title":267,"path":268,"stem":269},"App","\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fapp","3.modules\u002F2.commerce\u002F3.subscriptions\u002F3.app",{"title":179,"path":271,"stem":272},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Freference","3.modules\u002F2.commerce\u002F3.subscriptions\u002F4.reference",{"title":274,"icon":49,"path":275,"stem":276,"children":277,"page":49},"Features","\u002Fmodules\u002Ffeatures","3.modules\u002F3.features",[278,293,312,316],{"title":279,"path":280,"stem":281,"children":282},"Events","\u002Fmodules\u002Ffeatures\u002Fevents","3.modules\u002F3.features\u002F1.events\u002Findex",[283,284,287,290],{"title":173,"path":280,"stem":281},{"title":175,"path":285,"stem":286},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fserver","3.modules\u002F3.features\u002F1.events\u002F2.server",{"title":267,"path":288,"stem":289},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fapp","3.modules\u002F3.features\u002F1.events\u002F3.app",{"title":179,"path":291,"stem":292},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Freference","3.modules\u002F3.features\u002F1.events\u002F4.reference",{"title":294,"path":295,"stem":296,"children":297},"Forms","\u002Fmodules\u002Ffeatures\u002Fforms","3.modules\u002F3.features\u002F2.forms\u002Findex",[298,299,303,306,309],{"title":173,"path":295,"stem":296},{"title":300,"path":301,"stem":302},"Definition","\u002Fmodules\u002Ffeatures\u002Fforms\u002Fdefinition","3.modules\u002F3.features\u002F2.forms\u002F2.definition",{"title":175,"path":304,"stem":305},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fserver","3.modules\u002F3.features\u002F2.forms\u002F3.server",{"title":267,"path":307,"stem":308},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fapp","3.modules\u002F3.features\u002F2.forms\u002F4.app",{"title":179,"path":310,"stem":311},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Freference","3.modules\u002F3.features\u002F2.forms\u002F5.reference",{"title":313,"path":314,"stem":315},"Cookie Consent","\u002Fmodules\u002Ffeatures\u002Fcookie-consent","3.modules\u002F3.features\u002F3.cookie-consent",{"title":317,"path":318,"stem":319},"MCP","\u002Fmodules\u002Ffeatures\u002Fmcp","3.modules\u002F3.features\u002F4.mcp",{"title":321,"icon":49,"path":322,"stem":323,"children":324,"page":49},"Interface","\u002Fmodules\u002Finterface","3.modules\u002F4.interface",[325,350,353,357,361],{"title":326,"path":327,"stem":328,"children":329},"UI","\u002Fmodules\u002Finterface\u002Fui","3.modules\u002F4.interface\u002F1.ui\u002Findex",[330,331,335,339,343,347],{"title":173,"path":327,"stem":328},{"title":332,"path":333,"stem":334},"Page components","\u002Fmodules\u002Finterface\u002Fui\u002Fpage-components","3.modules\u002F4.interface\u002F1.ui\u002F2.page-components",{"title":336,"path":337,"stem":338},"App shell","\u002Fmodules\u002Finterface\u002Fui\u002Fapp-shell","3.modules\u002F4.interface\u002F1.ui\u002F3.app-shell",{"title":340,"path":341,"stem":342},"Form inputs","\u002Fmodules\u002Finterface\u002Fui\u002Fform-inputs","3.modules\u002F4.interface\u002F1.ui\u002F4.form-inputs",{"title":344,"path":345,"stem":346},"Composables and helpers","\u002Fmodules\u002Finterface\u002Fui\u002Fcomposables","3.modules\u002F4.interface\u002F1.ui\u002F5.composables",{"title":179,"path":348,"stem":349},"\u002Fmodules\u002Finterface\u002Fui\u002Freference","3.modules\u002F4.interface\u002F1.ui\u002F6.reference",{"title":217,"path":351,"stem":352},"\u002Fmodules\u002Finterface\u002Fadmin","3.modules\u002F4.interface\u002F2.admin",{"title":354,"path":355,"stem":356},"Menu","\u002Fmodules\u002Finterface\u002Fmenu","3.modules\u002F4.interface\u002F3.menu",{"title":358,"path":359,"stem":360},"Widget","\u002Fmodules\u002Finterface\u002Fwidget","3.modules\u002F4.interface\u002F4.widget",{"title":362,"path":363,"stem":364,"children":365},"Mobile","\u002Fmodules\u002Finterface\u002Fmobile","3.modules\u002F4.interface\u002F5.mobile\u002Findex",[366,367,371],{"title":173,"path":363,"stem":364},{"title":368,"path":369,"stem":370},"CLI and devices","\u002Fmodules\u002Finterface\u002Fmobile\u002Fcli-and-devices","3.modules\u002F4.interface\u002F5.mobile\u002F2.cli-and-devices",{"title":372,"path":373,"stem":374},"Splash screen","\u002Fmodules\u002Finterface\u002Fmobile\u002Fsplash-screen","3.modules\u002F4.interface\u002F5.mobile\u002F3.splash-screen",{"title":376,"icon":49,"path":377,"stem":378,"children":379,"page":49},"Platform","\u002Fmodules\u002Fplatform","3.modules\u002F5.platform",[380,402,406,423],{"title":381,"path":382,"stem":383,"children":384},"Module Kit","\u002Fmodules\u002Fplatform\u002Fmodule-kit","3.modules\u002F5.platform\u002F1.module-kit\u002Findex",[385,386,390,394,398],{"title":173,"path":382,"stem":383},{"title":387,"path":388,"stem":389},"Server toolkit","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fserver-toolkit","3.modules\u002F5.platform\u002F1.module-kit\u002F2.server-toolkit",{"title":391,"path":392,"stem":393},"Registries and menus","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fregistries-and-menus","3.modules\u002F5.platform\u002F1.module-kit\u002F3.registries-and-menus",{"title":395,"path":396,"stem":397},"Translations","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fi18n","3.modules\u002F5.platform\u002F1.module-kit\u002F4.i18n",{"title":399,"path":400,"stem":401},"Database helpers","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fdatabase","3.modules\u002F5.platform\u002F1.module-kit\u002F5.database",{"title":403,"path":404,"stem":405},"Notify","\u002Fmodules\u002Fplatform\u002Fnotify","3.modules\u002F5.platform\u002F2.notify",{"title":407,"path":408,"stem":409,"children":410},"Email Templates","\u002Fmodules\u002Fplatform\u002Femail-templates","3.modules\u002F5.platform\u002F3.email-templates\u002Findex",[411,412,416,419],{"title":173,"path":408,"stem":409},{"title":413,"path":414,"stem":415},"Email components","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fcomponents","3.modules\u002F5.platform\u002F3.email-templates\u002F2.components",{"title":175,"path":417,"stem":418},"\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fserver","3.modules\u002F5.platform\u002F3.email-templates\u002F3.server",{"title":420,"path":421,"stem":422},"Module emails","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fmodule-emails","3.modules\u002F5.platform\u002F3.email-templates\u002F4.module-emails",{"title":424,"path":425,"stem":426,"children":427},"Base Layer","\u002Fmodules\u002Fplatform\u002Fbase-layer","3.modules\u002F5.platform\u002F4.base-layer\u002Findex",[428,429,433,437],{"title":173,"path":425,"stem":426},{"title":430,"path":431,"stem":432},"Content collections","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcontent-collections","3.modules\u002F5.platform\u002F4.base-layer\u002F2.content-collections",{"title":434,"path":435,"stem":436},"Layouts and routing","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Flayouts-and-routing","3.modules\u002F5.platform\u002F4.base-layer\u002F3.layouts-and-routing",{"title":438,"path":439,"stem":440},"Composables and utils","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcomposables-and-utils","3.modules\u002F5.platform\u002F4.base-layer\u002F4.composables-and-utils",{"title":442,"icon":443,"path":444,"stem":445,"children":446,"page":49},"Examples","i-lucide-code-xml","\u002Fexamples","4.examples",[447,466,476],{"title":448,"icon":49,"path":449,"stem":450,"children":451,"page":49},"Starters","\u002Fexamples\u002Fstarters","4.examples\u002F1.starters",[452,456,461],{"title":453,"path":454,"stem":455,"icon":6},"Workspace starter","\u002Fexamples\u002Fstarters\u002Fworkspace","4.examples\u002F1.starters\u002F1.workspace",{"title":457,"path":458,"stem":459,"icon":460},"Mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile","4.examples\u002F1.starters\u002F2.mobile","i-lucide-smartphone",{"title":462,"path":463,"stem":464,"icon":465},"Standalone mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile-standalone","4.examples\u002F1.starters\u002F3.mobile-standalone","i-lucide-tablet-smartphone",{"title":467,"icon":49,"path":468,"stem":469,"children":470,"page":49},"Apps","\u002Fexamples\u002Fapps","4.examples\u002F2.apps",[471],{"title":472,"path":473,"stem":474,"icon":475},"Frigear website app","\u002Fexamples\u002Fapps\u002Ffrigear-nu-website","4.examples\u002F2.apps\u002F1.frigear-nu-website","i-lucide-layout-dashboard",{"title":477,"icon":49,"path":478,"stem":479,"children":480,"page":49},"Tasks","\u002Fexamples\u002Ftasks","4.examples\u002F3.tasks",[481,485,489,494,499],{"title":482,"path":483,"stem":484,"icon":70},"Protect a route","\u002Fexamples\u002Ftasks\u002Fprotect-a-route","4.examples\u002F3.tasks\u002F1.protect-a-route",{"title":486,"path":487,"stem":488,"icon":475},"Add an admin page","\u002Fexamples\u002Ftasks\u002Fadd-an-admin-page","4.examples\u002F3.tasks\u002F2.add-an-admin-page",{"title":490,"path":491,"stem":492,"icon":493},"Sell event tickets","\u002Fexamples\u002Ftasks\u002Fsell-event-tickets","4.examples\u002F3.tasks\u002F3.sell-event-tickets","i-lucide-ticket",{"title":495,"path":496,"stem":497,"icon":498},"Build a form","\u002Fexamples\u002Ftasks\u002Fbuild-a-form","4.examples\u002F3.tasks\u002F4.build-a-form","i-lucide-clipboard-list",{"title":500,"path":501,"stem":502,"icon":503},"Send an email","\u002Fexamples\u002Ftasks\u002Fsend-an-email","4.examples\u002F3.tasks\u002F5.send-an-email","i-lucide-mail",{"title":505,"icon":506,"path":507,"stem":508,"children":509,"page":49},"Contribute","i-lucide-git-pull-request","\u002Fcontribute","5.contribute",[510,513,518,544,549,552,556,571],{"title":173,"path":511,"stem":512,"icon":506},"\u002Fcontribute\u002Foverview","5.contribute\u002F1.overview",{"title":514,"path":515,"stem":516,"icon":517},"Local development","\u002Fcontribute\u002Flocal-development","5.contribute\u002F2.local-development","i-lucide-terminal",{"title":519,"icon":49,"path":520,"stem":521,"children":522,"page":49},"Writing a module","\u002Fcontribute\u002Fwriting-a-module","5.contribute\u002F3.writing-a-module",[523,527,532,536,541],{"title":524,"path":525,"stem":526,"icon":39},"Scaffold a module","\u002Fcontribute\u002Fwriting-a-module\u002Fscaffold","5.contribute\u002F3.writing-a-module\u002F1.scaffold",{"title":528,"path":529,"stem":530,"icon":531},"Setup checklist","\u002Fcontribute\u002Fwriting-a-module\u002Fsetup-checklist","5.contribute\u002F3.writing-a-module\u002F2.setup-checklist","i-lucide-list-checks",{"title":533,"path":534,"stem":535,"icon":44},"Database tables","\u002Fcontribute\u002Fwriting-a-module\u002Fdatabase-tables","5.contribute\u002F3.writing-a-module\u002F3.database-tables",{"title":537,"path":538,"stem":539,"icon":540},"Testing","\u002Fcontribute\u002Fwriting-a-module\u002Ftesting","5.contribute\u002F3.writing-a-module\u002F4.testing","i-lucide-flask-conical",{"title":67,"path":542,"stem":543,"icon":70},"\u002Fcontribute\u002Fwriting-a-module\u002Faccess-control","5.contribute\u002F3.writing-a-module\u002F5.access-control",{"title":545,"path":546,"stem":547,"icon":548},"Publishing","\u002Fcontribute\u002Fpublishing","5.contribute\u002F4.publishing","i-lucide-package-check",{"title":448,"path":550,"stem":551,"icon":6},"\u002Fcontribute\u002Fstarters","5.contribute\u002F5.starters",{"title":553,"path":554,"stem":555,"icon":52},"Documentation","\u002Fcontribute\u002Fdocumentation","5.contribute\u002F6.documentation",{"title":557,"icon":49,"path":558,"stem":559,"children":560,"page":49},"Tooling","\u002Fcontribute\u002Ftooling","5.contribute\u002F7.tooling",[561,566],{"title":562,"path":563,"stem":564,"icon":565},"CLI","\u002Fcontribute\u002Ftooling\u002Fcli","5.contribute\u002F7.tooling\u002F1.cli","i-lucide-square-terminal",{"title":567,"path":568,"stem":569,"icon":570},"ESLint config","\u002Fcontribute\u002Ftooling\u002Feslint-config","5.contribute\u002F7.tooling\u002F2.eslint-config","i-lucide-spell-check",{"title":572,"icon":49,"path":573,"stem":574,"children":575},"Decisions","\u002Fcontribute\u002Fdecisions","5.contribute\u002F8.decisions\u002Findex",[576,578,583],{"title":572,"path":573,"stem":574,"icon":577},"i-lucide-scale",{"title":579,"path":580,"stem":581,"icon":582},"Session lifetimes per OAuth client","\u002Fcontribute\u002Fdecisions\u002Foauth-token-lifetimes","5.contribute\u002F8.decisions\u002F1.oauth-token-lifetimes","i-lucide-timer",{"title":584,"path":585,"stem":586,"icon":70},"One permission model","\u002Fcontribute\u002Fdecisions\u002Fpermission-model","5.contribute\u002F8.decisions\u002F2.permission-model",{"id":588,"title":482,"body":589,"description":2044,"extension":2045,"links":2046,"meta":2047,"navigation":2048,"path":483,"seo":2049,"stem":484,"__hash__":2050},"docs\u002F4.examples\u002F3.tasks\u002F1.protect-a-route.md",{"type":590,"value":591,"toc":2034},"minimark",[592,605,610,637,648,652,671,945,952,1106,1183,1187,1202,1373,1398,1431,1451,1455,1462,1525,1534,1538,1548,1635,1675,1679,1689,1812,1834,1866,1870,2009,2013,2030],[593,594,595,599,600,604],"p",{},[596,597,598],"strong",{},"What you'll build:"," a ",[601,602,603],"code",{},"reports:read"," permission held by a role, a server route that checks it, a second route that\nonly a browser session may call, and a route rule for a page. Any other caller is refused with the right status.",[606,607,609],"h2",{"id":608},"prerequisites","Prerequisites",[611,612,613,632],"ul",{},[614,615,616,617,621,622,625,626,628,629,631],"li",{},"The ",[618,619,620],"a",{"href":454},"workspace starter",", or another ",[618,623,624],{"href":87},"host app"," with\n",[618,627,168],{"href":169}," and ",[618,630,199],{"href":200},".",[614,633,634,636],{},[618,635,67],{"href":68},", for the vocabulary: permission, role, scope, policy.",[593,638,639,640,643,644,647],{},"The paths below are for the starter's ",[601,641,642],{},"apps\u002Fweb",". In another host app, leave out the ",[601,645,646],{},"apps\u002Fweb\u002F"," prefix.",[606,649,651],{"id":650},"_1-register-the-permission","1. Register the permission",[593,653,654,655,658,659,662,663,666,667,670],{},"Code checks one kind of thing: a registered ",[596,656,657],{},"permission",", named ",[601,660,661],{},"resource:action",". An unregistered name is refused\nwith ",[601,664,665],{},"403 forbidden",", also for admins, so register it first. Declare it with ",[601,668,669],{},"defineAccess"," in a file the server can\nimport too:",[672,673,679],"pre",{"className":674,"code":675,"filename":676,"language":677,"meta":678,"style":678},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { defineAccess } from '@frigear-nu\u002Fauth\u002Faccess'\n\nexport const reportsAccess = defineAccess('reports', {\n  permissions: {\n    read: { label: 'Read reports', grantTo: ['admin'], implicit: true }, \u002F\u002F reports:read\n    manage: { label: 'Manage all reports', grantTo: ['admin'] }, \u002F\u002F reports:manage\n    \u002F\u002F Money and credentials: a cookie session only, never a token.\n    export: { label: 'Export reports', sessionOnly: true, grantTo: ['admin'] }, \u002F\u002F reports:export\n  },\n})\n","apps\u002Fweb\u002Fshared\u002Faccess\u002Freports.ts","ts","",[601,680,681,714,721,757,769,829,873,879,930,936],{"__ignoreMap":678},[682,683,686,690,694,698,701,704,707,711],"span",{"class":684,"line":685},"line",1,[682,687,689],{"class":688},"s7zQu","import",[682,691,693],{"class":692},"sMK4o"," {",[682,695,697],{"class":696},"sTEyZ"," defineAccess",[682,699,700],{"class":692}," }",[682,702,703],{"class":688}," from",[682,705,706],{"class":692}," '",[682,708,710],{"class":709},"sfazB","@frigear-nu\u002Fauth\u002Faccess",[682,712,713],{"class":692},"'\n",[682,715,717],{"class":684,"line":716},2,[682,718,720],{"emptyLinePlaceholder":719},true,"\n",[682,722,724,727,731,734,737,740,743,746,749,751,754],{"class":684,"line":723},3,[682,725,726],{"class":688},"export",[682,728,730],{"class":729},"spNyl"," const",[682,732,733],{"class":696}," reportsAccess ",[682,735,736],{"class":692},"=",[682,738,697],{"class":739},"s2Zo4",[682,741,742],{"class":696},"(",[682,744,745],{"class":692},"'",[682,747,748],{"class":709},"reports",[682,750,745],{"class":692},[682,752,753],{"class":692},",",[682,755,756],{"class":692}," {\n",[682,758,760,764,767],{"class":684,"line":759},4,[682,761,763],{"class":762},"swJcz","  permissions",[682,765,766],{"class":692},":",[682,768,756],{"class":692},[682,770,772,775,777,779,782,784,786,789,791,793,796,798,801,803,806,808,811,813,816,818,822,825],{"class":684,"line":771},5,[682,773,774],{"class":762},"    read",[682,776,766],{"class":692},[682,778,693],{"class":692},[682,780,781],{"class":762}," label",[682,783,766],{"class":692},[682,785,706],{"class":692},[682,787,788],{"class":709},"Read reports",[682,790,745],{"class":692},[682,792,753],{"class":692},[682,794,795],{"class":762}," grantTo",[682,797,766],{"class":692},[682,799,800],{"class":696}," [",[682,802,745],{"class":692},[682,804,805],{"class":709},"admin",[682,807,745],{"class":692},[682,809,810],{"class":696},"]",[682,812,753],{"class":692},[682,814,815],{"class":762}," implicit",[682,817,766],{"class":692},[682,819,821],{"class":820},"sfNiH"," true",[682,823,824],{"class":692}," },",[682,826,828],{"class":827},"sHwdD"," \u002F\u002F reports:read\n",[682,830,832,835,837,839,841,843,845,848,850,852,854,856,858,860,862,864,867,870],{"class":684,"line":831},6,[682,833,834],{"class":762},"    manage",[682,836,766],{"class":692},[682,838,693],{"class":692},[682,840,781],{"class":762},[682,842,766],{"class":692},[682,844,706],{"class":692},[682,846,847],{"class":709},"Manage all reports",[682,849,745],{"class":692},[682,851,753],{"class":692},[682,853,795],{"class":762},[682,855,766],{"class":692},[682,857,800],{"class":696},[682,859,745],{"class":692},[682,861,805],{"class":709},[682,863,745],{"class":692},[682,865,866],{"class":696},"] ",[682,868,869],{"class":692},"},",[682,871,872],{"class":827}," \u002F\u002F reports:manage\n",[682,874,876],{"class":684,"line":875},7,[682,877,878],{"class":827},"    \u002F\u002F Money and credentials: a cookie session only, never a token.\n",[682,880,882,885,887,889,891,893,895,898,900,902,905,907,909,911,913,915,917,919,921,923,925,927],{"class":684,"line":881},8,[682,883,884],{"class":762},"    export",[682,886,766],{"class":692},[682,888,693],{"class":692},[682,890,781],{"class":762},[682,892,766],{"class":692},[682,894,706],{"class":692},[682,896,897],{"class":709},"Export reports",[682,899,745],{"class":692},[682,901,753],{"class":692},[682,903,904],{"class":762}," sessionOnly",[682,906,766],{"class":692},[682,908,821],{"class":820},[682,910,753],{"class":692},[682,912,795],{"class":762},[682,914,766],{"class":692},[682,916,800],{"class":696},[682,918,745],{"class":692},[682,920,805],{"class":709},[682,922,745],{"class":692},[682,924,866],{"class":696},[682,926,869],{"class":692},[682,928,929],{"class":827}," \u002F\u002F reports:export\n",[682,931,933],{"class":684,"line":932},9,[682,934,935],{"class":692},"  },\n",[682,937,939,942],{"class":684,"line":938},10,[682,940,941],{"class":692},"}",[682,943,944],{"class":696},")\n",[593,946,947,948,951],{},"A host app has no module of its own, so register it from a local one. Nuxt registers every file in\n",[601,949,950],{},"apps\u002Fweb\u002Fmodules\u002F"," as a module.",[672,953,956],{"className":674,"code":954,"filename":955,"language":677,"meta":678,"style":678},"import { defineNuxtModule } from 'nuxt\u002Fkit'\nimport { registerAccess } from '@frigear-nu\u002Fauth\u002Futils'\nimport { reportsAccess } from '..\u002Fshared\u002Faccess\u002Freports'\n\nexport default defineNuxtModule({\n  meta: { name: 'reports' },\n  setup(_options, nuxt) {\n    registerAccess(nuxt, reportsAccess)\n  },\n})\n","apps\u002Fweb\u002Fmodules\u002Freports.ts",[601,957,958,978,998,1018,1022,1036,1059,1080,1096,1100],{"__ignoreMap":678},[682,959,960,962,964,967,969,971,973,976],{"class":684,"line":685},[682,961,689],{"class":688},[682,963,693],{"class":692},[682,965,966],{"class":696}," defineNuxtModule",[682,968,700],{"class":692},[682,970,703],{"class":688},[682,972,706],{"class":692},[682,974,975],{"class":709},"nuxt\u002Fkit",[682,977,713],{"class":692},[682,979,980,982,984,987,989,991,993,996],{"class":684,"line":716},[682,981,689],{"class":688},[682,983,693],{"class":692},[682,985,986],{"class":696}," registerAccess",[682,988,700],{"class":692},[682,990,703],{"class":688},[682,992,706],{"class":692},[682,994,995],{"class":709},"@frigear-nu\u002Fauth\u002Futils",[682,997,713],{"class":692},[682,999,1000,1002,1004,1007,1009,1011,1013,1016],{"class":684,"line":723},[682,1001,689],{"class":688},[682,1003,693],{"class":692},[682,1005,1006],{"class":696}," reportsAccess",[682,1008,700],{"class":692},[682,1010,703],{"class":688},[682,1012,706],{"class":692},[682,1014,1015],{"class":709},"..\u002Fshared\u002Faccess\u002Freports",[682,1017,713],{"class":692},[682,1019,1020],{"class":684,"line":759},[682,1021,720],{"emptyLinePlaceholder":719},[682,1023,1024,1026,1029,1031,1033],{"class":684,"line":771},[682,1025,726],{"class":688},[682,1027,1028],{"class":688}," default",[682,1030,966],{"class":739},[682,1032,742],{"class":696},[682,1034,1035],{"class":692},"{\n",[682,1037,1038,1041,1043,1045,1048,1050,1052,1054,1056],{"class":684,"line":831},[682,1039,1040],{"class":762},"  meta",[682,1042,766],{"class":692},[682,1044,693],{"class":692},[682,1046,1047],{"class":762}," name",[682,1049,766],{"class":692},[682,1051,706],{"class":692},[682,1053,748],{"class":709},[682,1055,745],{"class":692},[682,1057,1058],{"class":692}," },\n",[682,1060,1061,1064,1066,1070,1072,1075,1078],{"class":684,"line":875},[682,1062,1063],{"class":762},"  setup",[682,1065,742],{"class":692},[682,1067,1069],{"class":1068},"sHdIc","_options",[682,1071,753],{"class":692},[682,1073,1074],{"class":1068}," nuxt",[682,1076,1077],{"class":692},")",[682,1079,756],{"class":692},[682,1081,1082,1085,1087,1090,1092,1094],{"class":684,"line":881},[682,1083,1084],{"class":739},"    registerAccess",[682,1086,742],{"class":762},[682,1088,1089],{"class":696},"nuxt",[682,1091,753],{"class":692},[682,1093,1006],{"class":696},[682,1095,944],{"class":762},[682,1097,1098],{"class":684,"line":932},[682,1099,935],{"class":692},[682,1101,1102,1104],{"class":684,"line":938},[682,1103,941],{"class":692},[682,1105,944],{"class":696},[611,1107,1108,1117,1133,1145,1155,1173],{},[614,1109,1110,1113,1114,1116],{},[601,1111,1112],{},"implicit"," gives ",[601,1115,603],{}," to every signed-in user (self-service); the policy in step 5 then limits it to the\nuser's own reports. Leave it out for a staff-only permission.",[614,1118,1119,1122,1123,1125,1126,1129,1130,631],{},[601,1120,1121],{},"grantTo"," puts the permission into the ",[601,1124,805],{}," role by name. A host can also grant it in ",[601,1127,1128],{},"authorization.roles",":\n",[601,1131,1132],{},"grant: ['reports:read']",[614,1134,1135,1113,1138,1140,1141,1144],{},[601,1136,1137],{},"*",[601,1139,805],{}," every non-sensitive permission anyway. Permissions that expose other people's personal data end in\n",[601,1142,1143],{},":pii",", are sensitive by default, and are granted by name only.",[614,1146,1147,1148,1151,1152,631],{},"The labels' i18n keys are derived: ",[601,1149,1150],{},"reports.permissions.read",". Add them to your locale files, or keep the ",[601,1153,1154],{},"label",[614,1156,1157,1158,1161,1162,1165,1166,1168,1169,1172],{},"After the next ",[601,1159,1160],{},"nuxi prepare"," (or ",[601,1163,1164],{},"pnpm dev","), ",[601,1167,603],{}," is part of the generated ",[601,1170,1171],{},"Permission"," type, so a typo in\nany check below fails typecheck.",[614,1174,1175,1176,1179,1180,631],{},"A module declares its permissions the same way, in ",[601,1177,1178],{},"src\u002Fruntime\u002Faccess.ts",". See\n",[618,1181,1182],{"href":542},"Access control for module authors",[606,1184,1186],{"id":1185},"_2-check-it-on-a-route","2. Check it on a route",[593,1188,1189,1190,1193,1194,1197,1198,1201],{},"Every route follows the same two steps. Check the permission ",[596,1191,1192],{},"before"," you load anything, so a missing record never\nanswers ",[601,1195,1196],{},"404"," to someone who may not know it exists. When the check is about one record, check again with the record,\nso ",[618,1199,1200],{"href":210},"policies"," can refine it.",[672,1203,1206],{"className":674,"code":1204,"filename":1205,"language":677,"meta":678,"style":678},"export default defineEventHandler(async (event) => {\n  await authorize(event, 'reports:read') \u002F\u002F 401 or 403 before anything else\n  const { id } = await getValidatedRouterParams(event, intIdParams().parse)\n  const report = await loadReport(id) \u002F\u002F then 404\n  await authorize(event, 'reports:read', report) \u002F\u002F record-level policies\n  return toReportDto(report)\n})\n","apps\u002Fweb\u002Fserver\u002Fapi\u002Freports\u002F[id].get.ts",[601,1207,1208,1235,1261,1301,1325,1352,1367],{"__ignoreMap":678},[682,1209,1210,1212,1214,1217,1219,1222,1225,1228,1230,1233],{"class":684,"line":685},[682,1211,726],{"class":688},[682,1213,1028],{"class":688},[682,1215,1216],{"class":739}," defineEventHandler",[682,1218,742],{"class":696},[682,1220,1221],{"class":729},"async",[682,1223,1224],{"class":692}," (",[682,1226,1227],{"class":1068},"event",[682,1229,1077],{"class":692},[682,1231,1232],{"class":729}," =>",[682,1234,756],{"class":692},[682,1236,1237,1240,1243,1245,1247,1249,1251,1253,1255,1258],{"class":684,"line":716},[682,1238,1239],{"class":688},"  await",[682,1241,1242],{"class":739}," authorize",[682,1244,742],{"class":762},[682,1246,1227],{"class":696},[682,1248,753],{"class":692},[682,1250,706],{"class":692},[682,1252,603],{"class":709},[682,1254,745],{"class":692},[682,1256,1257],{"class":762},") ",[682,1259,1260],{"class":827},"\u002F\u002F 401 or 403 before anything else\n",[682,1262,1263,1266,1268,1271,1273,1276,1279,1282,1284,1286,1288,1291,1294,1296,1299],{"class":684,"line":723},[682,1264,1265],{"class":729},"  const",[682,1267,693],{"class":692},[682,1269,1270],{"class":696}," id",[682,1272,700],{"class":692},[682,1274,1275],{"class":692}," =",[682,1277,1278],{"class":688}," await",[682,1280,1281],{"class":739}," getValidatedRouterParams",[682,1283,742],{"class":762},[682,1285,1227],{"class":696},[682,1287,753],{"class":692},[682,1289,1290],{"class":739}," intIdParams",[682,1292,1293],{"class":762},"()",[682,1295,631],{"class":692},[682,1297,1298],{"class":696},"parse",[682,1300,944],{"class":762},[682,1302,1303,1305,1308,1310,1312,1315,1317,1320,1322],{"class":684,"line":759},[682,1304,1265],{"class":729},[682,1306,1307],{"class":696}," report",[682,1309,1275],{"class":692},[682,1311,1278],{"class":688},[682,1313,1314],{"class":739}," loadReport",[682,1316,742],{"class":762},[682,1318,1319],{"class":696},"id",[682,1321,1257],{"class":762},[682,1323,1324],{"class":827},"\u002F\u002F then 404\n",[682,1326,1327,1329,1331,1333,1335,1337,1339,1341,1343,1345,1347,1349],{"class":684,"line":771},[682,1328,1239],{"class":688},[682,1330,1242],{"class":739},[682,1332,742],{"class":762},[682,1334,1227],{"class":696},[682,1336,753],{"class":692},[682,1338,706],{"class":692},[682,1340,603],{"class":709},[682,1342,745],{"class":692},[682,1344,753],{"class":692},[682,1346,1307],{"class":696},[682,1348,1257],{"class":762},[682,1350,1351],{"class":827},"\u002F\u002F record-level policies\n",[682,1353,1354,1357,1360,1362,1365],{"class":684,"line":831},[682,1355,1356],{"class":688},"  return",[682,1358,1359],{"class":739}," toReportDto",[682,1361,742],{"class":762},[682,1363,1364],{"class":696},"report",[682,1366,944],{"class":762},[682,1368,1369,1371],{"class":684,"line":875},[682,1370,941],{"class":692},[682,1372,944],{"class":696},[593,1374,1375,1378,1379,1382,1383,628,1386,1389,1390,1393,1394,1397],{},[601,1376,1377],{},"authorize"," is auto-imported in server code. ",[601,1380,1381],{},"loadReport",", ",[601,1384,1385],{},"toReportDto",[601,1387,1388],{},"intIdParams"," stand for your own\nfunctions and the module-kit helper. The string is typed: ",[601,1391,1392],{},"authorize(event, 'reports:raed')"," fails typecheck. You can\nalso name it through the declaration, ",[601,1395,1396],{},"authorize(event, reportsAccess.permissions.read)",", so renaming it is one edit.",[611,1399,1400,1410,1417],{},[614,1401,1402,1403,1406,1407,631],{},"It returns the ",[618,1404,1405],{"href":87},"principal",": the user and how they proved who they are. Use it when you\nneed the user: ",[601,1408,1409],{},"const { user } = await authorize(event, 'reports:read')",[614,1411,1412,1413,1416],{},"It accepts a cookie session, an API token and an OAuth access token. A token needs the permission frozen into it\nwhen it was issued: ",[601,1414,1415],{},"403 insufficient_scope"," otherwise.",[614,1418,1419,1422,1423,1426,1427,1430],{},[601,1420,1421],{},"allows(event, permission, record?)"," answers ",[601,1424,1425],{},"true"," or ",[601,1428,1429],{},"false"," instead of throwing, for a route that changes what it\nreturns.",[1432,1433,1434,1435,1438,1439,1442,1443,1446,1447,1450],"tip",{},"Do not use nuxt-auth-utils' ",[601,1436,1437],{},"requireUserSession",", and do not pass ",[601,1440,1441],{},"scopes"," to ",[601,1444,1445],{},"requireAuth",": it no longer takes them.\n",[601,1448,1449],{},"requireAuth(event)"," only answers who is calling, for a route no permission describes.",[606,1452,1454],{"id":1453},"_3-allow-cookie-sessions-only","3. Allow cookie sessions only",[593,1456,1457,1458,1461],{},"Anything that moves money, or changes who someone is or how they sign in, gets its own ",[601,1459,1460],{},"sessionOnly"," permission. The\npermission carries the rule, not the route, so no call can forget it.",[672,1463,1466],{"className":674,"code":1464,"filename":1465,"language":677,"meta":678,"style":678},"export default defineEventHandler(async (event) => {\n  await authorize(event, 'reports:export') \u002F\u002F 403 session_required for a token\n  \u002F\u002F ... build the export\n})\n","apps\u002Fweb\u002Fserver\u002Fapi\u002Freports\u002Fexport.post.ts",[601,1467,1468,1490,1514,1519],{"__ignoreMap":678},[682,1469,1470,1472,1474,1476,1478,1480,1482,1484,1486,1488],{"class":684,"line":685},[682,1471,726],{"class":688},[682,1473,1028],{"class":688},[682,1475,1216],{"class":739},[682,1477,742],{"class":696},[682,1479,1221],{"class":729},[682,1481,1224],{"class":692},[682,1483,1227],{"class":1068},[682,1485,1077],{"class":692},[682,1487,1232],{"class":729},[682,1489,756],{"class":692},[682,1491,1492,1494,1496,1498,1500,1502,1504,1507,1509,1511],{"class":684,"line":716},[682,1493,1239],{"class":688},[682,1495,1242],{"class":739},[682,1497,742],{"class":762},[682,1499,1227],{"class":696},[682,1501,753],{"class":692},[682,1503,706],{"class":692},[682,1505,1506],{"class":709},"reports:export",[682,1508,745],{"class":692},[682,1510,1257],{"class":762},[682,1512,1513],{"class":827},"\u002F\u002F 403 session_required for a token\n",[682,1515,1516],{"class":684,"line":723},[682,1517,1518],{"class":827},"  \u002F\u002F ... build the export\n",[682,1520,1521,1523],{"class":684,"line":759},[682,1522,941],{"class":692},[682,1524,944],{"class":696},[1526,1527,1528,1529,1531,1532,631],"caution",{},"A ",[601,1530,1460],{}," permission is never held by an API token or an OAuth token, and is never offered as a scope, even when\na role grants it. For credentials, billing and account changes, see\n",[618,1533,1460],{"href":68},[606,1535,1537],{"id":1536},"_4-guard-a-page-with-a-route-rule","4. Guard a page with a route rule",[593,1539,1540,1541,1544,1545,1547],{},"A route rule names the permission a path needs. Auth's server middleware enforces it for ",[601,1542,1543],{},"\u002Fapi\u002F**",", and\nAuthorization's page middleware for pages. It is a coarse first gate: keep the ",[601,1546,1377],{}," call in the handler.",[672,1549,1552],{"className":674,"code":1550,"filename":1551,"language":677,"meta":678,"style":678},"export default defineNuxtConfig({\n  routeRules: {\n    '\u002Freports\u002F**': { permission: 'reports:read' },\n    '\u002Fsign-in': { guest: true },\n  },\n})\n","apps\u002Fweb\u002Fnuxt.config.ts",[601,1553,1554,1567,1576,1603,1625,1629],{"__ignoreMap":678},[682,1555,1556,1558,1560,1563,1565],{"class":684,"line":685},[682,1557,726],{"class":688},[682,1559,1028],{"class":688},[682,1561,1562],{"class":739}," defineNuxtConfig",[682,1564,742],{"class":696},[682,1566,1035],{"class":692},[682,1568,1569,1572,1574],{"class":684,"line":716},[682,1570,1571],{"class":762},"  routeRules",[682,1573,766],{"class":692},[682,1575,756],{"class":692},[682,1577,1578,1581,1584,1586,1588,1590,1593,1595,1597,1599,1601],{"class":684,"line":723},[682,1579,1580],{"class":692},"    '",[682,1582,1583],{"class":762},"\u002Freports\u002F**",[682,1585,745],{"class":692},[682,1587,766],{"class":692},[682,1589,693],{"class":692},[682,1591,1592],{"class":762}," permission",[682,1594,766],{"class":692},[682,1596,706],{"class":692},[682,1598,603],{"class":709},[682,1600,745],{"class":692},[682,1602,1058],{"class":692},[682,1604,1605,1607,1610,1612,1614,1616,1619,1621,1623],{"class":684,"line":759},[682,1606,1580],{"class":692},[682,1608,1609],{"class":762},"\u002Fsign-in",[682,1611,745],{"class":692},[682,1613,766],{"class":692},[682,1615,693],{"class":692},[682,1617,1618],{"class":762}," guest",[682,1620,766],{"class":692},[682,1622,821],{"class":820},[682,1624,1058],{"class":692},[682,1626,1627],{"class":684,"line":771},[682,1628,935],{"class":692},[682,1630,1631,1633],{"class":684,"line":831},[682,1632,941],{"class":692},[682,1634,944],{"class":696},[611,1636,1637,1658,1664],{},[614,1638,1639,1640,1382,1642,628,1645,1648,1649,1382,1652,628,1655,1657],{},"The keys are ",[601,1641,657],{},[601,1643,1644],{},"authenticated",[601,1646,1647],{},"guest",". The old ",[601,1650,1651],{},"roles",[601,1653,1654],{},"ability",[601,1656,1441],{}," keys fail the build.",[614,1659,1660,1661,631],{},"A page can set its own rule: ",[601,1662,1663],{},"definePageMeta({ authorize: 'reports:read' })",[614,1665,1666,1667,1670,1671,1674],{},"Hide what a visitor cannot use with ",[601,1668,1669],{},"\u003CCan permission=\"reports:export\">…\u003C\u002FCan>",", and ",[601,1672,1673],{},"\u003CCannot>"," for the opposite. The\nAPI decides what is allowed; the component only decides what is shown.",[606,1676,1678],{"id":1677},"_5-add-your-own-rule","5. Add your own rule",[593,1680,1681,1682,1684,1685,1688],{},"A permission plus a role says what a user may do in general. A record rule narrows it. Put it in a policy: it can\ndeny, never grant. A policy that returns ",[601,1683,1429],{}," denies, so a rule that should only restrict some callers returns\n",[601,1686,1687],{},"undefined"," for the rest.",[672,1690,1693],{"className":674,"code":1691,"filename":1692,"language":677,"meta":678,"style":678},"\u002F\u002F definePolicy is auto-imported in server code. Export each policy, or an array of them.\n\u002F\u002F Only the owner may read a report, unless the caller can manage them all (`reports:manage`, checked in the policy).\nexport const reportOwner = definePolicy\u003C{ ownerId: number }>('reports:read', async ({ event, user, record }) =>\n  record.ownerId === user.id || await allows(event, 'reports:manage'))\n","apps\u002Fweb\u002Fserver\u002Fpolicies.ts",[601,1694,1695,1700,1705,1769],{"__ignoreMap":678},[682,1696,1697],{"class":684,"line":685},[682,1698,1699],{"class":827},"\u002F\u002F definePolicy is auto-imported in server code. Export each policy, or an array of them.\n",[682,1701,1702],{"class":684,"line":716},[682,1703,1704],{"class":827},"\u002F\u002F Only the owner may read a report, unless the caller can manage them all (`reports:manage`, checked in the policy).\n",[682,1706,1707,1709,1711,1714,1716,1719,1722,1725,1727,1731,1734,1736,1738,1740,1742,1744,1747,1750,1753,1755,1758,1760,1763,1766],{"class":684,"line":723},[682,1708,726],{"class":688},[682,1710,730],{"class":729},[682,1712,1713],{"class":696}," reportOwner ",[682,1715,736],{"class":692},[682,1717,1718],{"class":739}," definePolicy",[682,1720,1721],{"class":692},"\u003C{",[682,1723,1724],{"class":762}," ownerId",[682,1726,766],{"class":692},[682,1728,1730],{"class":1729},"sBMFI"," number",[682,1732,1733],{"class":692}," }>",[682,1735,742],{"class":696},[682,1737,745],{"class":692},[682,1739,603],{"class":709},[682,1741,745],{"class":692},[682,1743,753],{"class":692},[682,1745,1746],{"class":729}," async",[682,1748,1749],{"class":692}," ({",[682,1751,1752],{"class":1068}," event",[682,1754,753],{"class":692},[682,1756,1757],{"class":1068}," user",[682,1759,753],{"class":692},[682,1761,1762],{"class":1068}," record",[682,1764,1765],{"class":692}," })",[682,1767,1768],{"class":729}," =>\n",[682,1770,1771,1774,1776,1779,1782,1784,1786,1789,1792,1794,1797,1800,1802,1804,1807,1809],{"class":684,"line":759},[682,1772,1773],{"class":696},"  record",[682,1775,631],{"class":692},[682,1777,1778],{"class":696},"ownerId ",[682,1780,1781],{"class":692},"===",[682,1783,1757],{"class":696},[682,1785,631],{"class":692},[682,1787,1788],{"class":696},"id ",[682,1790,1791],{"class":692},"||",[682,1793,1278],{"class":688},[682,1795,1796],{"class":739}," allows",[682,1798,1799],{"class":696},"(event",[682,1801,753],{"class":692},[682,1803,706],{"class":692},[682,1805,1806],{"class":709},"reports:manage",[682,1808,745],{"class":692},[682,1810,1811],{"class":696},"))\n",[593,1813,1814,1815,1426,1817,1819,1820,1822,1823,1826,1827,1830,1831,631],{},"Returning ",[601,1816,1425],{},[601,1818,1687],{}," keeps the role's answer, ",[601,1821,1429],{}," (or a throw) denies. The host's ",[601,1824,1825],{},"server\u002Fpolicies.ts"," is picked up when it\nexists. For a rule that must also run in the browser's ",[601,1828,1829],{},"can()",", see\n",[618,1832,1833],{"href":210},"shared policies",[1835,1836,1839,1842,1843,1846,1847,1850,1851,1853,1854,1856,1857,1670,1859,1862,1863,631],"callout",{"color":1837,"icon":1838},"success","i-lucide-check",[596,1840,1841],{},"What you should see:"," signed in as an admin, ",[601,1844,1845],{},"GET \u002Fapi\u002Freports\u002F1"," answers the report. Signed out it answers ",[601,1848,1849],{},"401",".\nSigned in as a plain user it answers the user's own report and ",[601,1852,665],{}," for someone else's. With an API token created without ",[601,1855,603],{}," it answers\n",[601,1858,1415],{},[601,1860,1861],{},"POST \u002Fapi\u002Freports\u002Fexport"," with any token answers ",[601,1864,1865],{},"403 session_required",[606,1867,1869],{"id":1868},"troubleshooting","Troubleshooting",[1871,1872,1873,1889],"table",{},[1874,1875,1876],"thead",{},[1877,1878,1879,1883,1886],"tr",{},[1880,1881,1882],"th",{},"Symptom",[1880,1884,1885],{},"Cause",[1880,1887,1888],{},"Fix",[1890,1891,1892,1917,1942,1961,1973,1988],"tbody",{},[1877,1893,1894,1900,1903],{},[1895,1896,1897,1899],"td",{},[601,1898,665],{}," for an admin",[1895,1901,1902],{},"The permission is not registered (a typo, or the module is not installed).",[1895,1904,1905,1906,1161,1909,1912,1913,1916],{},"Register it with ",[601,1907,1908],{},"registerAccess",[601,1910,1911],{},"addPermission","). In development the server also logs an error, and ",[601,1914,1915],{},"pnpm typecheck"," flags the typo.",[1877,1918,1919,1924,1933],{},[1895,1920,1921,1923],{},[601,1922,665],{}," for a user with the right role",[1895,1925,1926,1927,1929,1930,1932],{},"The role does not hold it, or a policy denied the record. ",[601,1928,1137],{}," does not cover ",[601,1931,1143],{}," permissions.",[1895,1934,1935,1936,1939,1940,631],{},"Add the permission to the role's ",[601,1937,1938],{},"grant",", or ",[601,1941,1121],{},[1877,1943,1944,1949,1955],{},[1895,1945,1946,1948],{},[601,1947,1849],{}," with an API token",[1895,1950,1951,1952,1954],{},"The token is not in the ",[601,1953,199],{}," header.",[1895,1956,1957,1958,631],{},"Send ",[601,1959,1960],{},"Authorization: Bearer \u003Ctoken>",[1877,1962,1963,1967,1970],{},[1895,1964,1965],{},[601,1966,1415],{},[1895,1968,1969],{},"The token was minted without the permission, or before the upgrade.",[1895,1971,1972],{},"Mint a token that carries it.",[1877,1974,1975,1979,1985],{},[1895,1976,1977],{},[601,1978,1865],{},[1895,1980,1981,1982,1984],{},"The permission is ",[601,1983,1460],{}," and the request used a token.",[1895,1986,1987],{},"Call it from the browser, signed in.",[1877,1989,1990,1993,2003],{},[1895,1991,1992],{},"The build fails on a route rule",[1895,1994,1995,1996,1382,1998,1426,2000,2002],{},"The rule uses ",[601,1997,1651],{},[601,1999,1654],{},[601,2001,1441],{},", or names an unknown permission.",[1895,2004,2005,2006,2008],{},"Use ",[601,2007,657],{}," with a registered name.",[606,2010,2012],{"id":2011},"next-steps","Next steps",[611,2014,2015,2020,2025],{},[614,2016,2017,2019],{},[618,2018,121],{"href":122}," – give the route the error shapes and responses every module uses.",[614,2021,2022,2024],{},[618,2023,486],{"href":487}," – put a staff page in front of a protected route.",[614,2026,2027,2029],{},[618,2028,151],{"href":152}," – move off the old APIs.",[2031,2032,2033],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}",{"title":678,"searchDepth":716,"depth":716,"links":2035},[2036,2037,2038,2039,2040,2041,2042,2043],{"id":608,"depth":716,"text":609},{"id":650,"depth":716,"text":651},{"id":1185,"depth":716,"text":1186},{"id":1453,"depth":716,"text":1454},{"id":1536,"depth":716,"text":1537},{"id":1677,"depth":716,"text":1678},{"id":1868,"depth":716,"text":1869},{"id":2011,"depth":716,"text":2012},"Declare a permission with defineAccess, check it on a server route with authorize, keep money and credential actions to cookie sessions, and guard pages with route rules.","md",null,{},{"icon":70},{"title":482,"description":2044},"HzA1q-sT0xuM_zMDGzvfCRahUzXZgLQ3csgLdpzpPQE",[2052,2054],{"title":472,"path":473,"stem":474,"description":2053,"icon":475,"children":-1},"The reference host app behind frigear.nu, with its modules, content, environment, database and deployment.",{"title":486,"path":487,"stem":488,"description":2055,"icon":475,"children":-1},"Add a list page with a sidebar entry to the admin area, built from the shared page components.",1794503140360]