[{"data":1,"prerenderedAt":2102},["ShallowReactive",2],{"navigation_docs":3,"-get-started-authentication":587,"-get-started-authentication-surround":2097},[4,50,155,441,504],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":49},"Get Started","i-lucide-rocket","\u002Fget-started","1.get-started",[10,15,20,25,30,35,40,45],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fget-started\u002Fintroduction","1.get-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Installation","\u002Fget-started\u002Finstallation","1.get-started\u002F2.installation","i-lucide-download",{"title":21,"path":22,"stem":23,"icon":24},"Project structure","\u002Fget-started\u002Fproject-structure","1.get-started\u002F3.project-structure","i-lucide-folder-tree",{"title":26,"path":27,"stem":28,"icon":29},"Configuration","\u002Fget-started\u002Fconfiguration","1.get-started\u002F4.configuration","i-lucide-settings",{"title":31,"path":32,"stem":33,"icon":34},"Authentication","\u002Fget-started\u002Fauthentication","1.get-started\u002F5.authentication","i-lucide-lock",{"title":36,"path":37,"stem":38,"icon":39},"Adding modules","\u002Fget-started\u002Fadding-modules","1.get-started\u002F6.adding-modules","i-lucide-puzzle",{"title":41,"path":42,"stem":43,"icon":44},"Database","\u002Fget-started\u002Fdatabase","1.get-started\u002F7.database","i-lucide-database",{"title":46,"path":47,"stem":48,"icon":6},"Deployment","\u002Fget-started\u002Fdeployment","1.get-started\u002F8.deployment",false,{"title":51,"icon":52,"path":53,"stem":54,"children":55,"page":49},"Guide","i-lucide-book-open","\u002Fguide","2.guide",[56,90,115,125],{"title":57,"icon":49,"path":58,"stem":59,"children":60,"page":49},"Concepts","\u002Fguide\u002Fconcepts","2.guide\u002F1.concepts",[61,66,71,76,80,85],{"title":62,"path":63,"stem":64,"icon":65},"Architecture","\u002Fguide\u002Fconcepts\u002Farchitecture","2.guide\u002F1.concepts\u002F1.architecture","i-lucide-blocks",{"title":67,"path":68,"stem":69,"icon":70},"Access control","\u002Fguide\u002Fconcepts\u002Fauth-and-scopes","2.guide\u002F1.concepts\u002F2.auth-and-scopes","i-lucide-shield-check",{"title":72,"path":73,"stem":74,"icon":75},"Extension points","\u002Fguide\u002Fconcepts\u002Fextension-points","2.guide\u002F1.concepts\u002F3.extension-points","i-lucide-plug",{"title":77,"path":78,"stem":79,"icon":44},"Database extensions","\u002Fguide\u002Fconcepts\u002Fdatabase-extensions","2.guide\u002F1.concepts\u002F4.database-extensions",{"title":81,"path":82,"stem":83,"icon":84},"Identity","\u002Fguide\u002Fconcepts\u002Fidentity","2.guide\u002F1.concepts\u002F5.identity","i-lucide-fingerprint",{"title":86,"path":87,"stem":88,"icon":89},"Glossary","\u002Fguide\u002Fconcepts\u002Fglossary","2.guide\u002F1.concepts\u002F6.glossary","i-lucide-book-a",{"title":91,"icon":49,"path":92,"stem":93,"children":94,"page":49},"UX patterns","\u002Fguide\u002Fux-patterns","2.guide\u002F2.ux-patterns",[95,100,105,110],{"title":96,"path":97,"stem":98,"icon":99},"Layouts and navigation","\u002Fguide\u002Fux-patterns\u002Flayouts-and-navigation","2.guide\u002F2.ux-patterns\u002F1.layouts-and-navigation","i-lucide-layout-template",{"title":101,"path":102,"stem":103,"icon":104},"Pages","\u002Fguide\u002Fux-patterns\u002Fpages","2.guide\u002F2.ux-patterns\u002F2.pages","i-lucide-table",{"title":106,"path":107,"stem":108,"icon":109},"Forms and actions","\u002Fguide\u002Fux-patterns\u002Fforms-and-actions","2.guide\u002F2.ux-patterns\u002F3.forms-and-actions","i-lucide-square-pen",{"title":111,"path":112,"stem":113,"icon":114},"Text and formatting","\u002Fguide\u002Fux-patterns\u002Ftext-and-formatting","2.guide\u002F2.ux-patterns\u002F4.text-and-formatting","i-lucide-type",{"title":116,"icon":49,"path":117,"stem":118,"children":119,"page":49},"Best practices","\u002Fguide\u002Fbest-practices","2.guide\u002F3.best-practices",[120],{"title":121,"path":122,"stem":123,"icon":124},"HTTP routes","\u002Fguide\u002Fbest-practices\u002Fhttp-routes","2.guide\u002F3.best-practices\u002F1.http-routes","i-lucide-route",{"title":126,"icon":49,"path":127,"stem":128,"children":129,"page":49},"Going further","\u002Fguide\u002Fgoing-further","2.guide\u002F4.going-further",[130,135,140,145,150],{"title":131,"path":132,"stem":133,"icon":134},"Use your own OAuth server","\u002Fguide\u002Fgoing-further\u002Fown-oauth-server","2.guide\u002F4.going-further\u002F1.own-oauth-server","i-lucide-key-round",{"title":136,"path":137,"stem":138,"icon":139},"Create an OAuth application","\u002Fguide\u002Fgoing-further\u002Foauth-application","2.guide\u002F4.going-further\u002F2.oauth-application","i-lucide-app-window",{"title":141,"path":142,"stem":143,"icon":144},"Signing keys","\u002Fguide\u002Fgoing-further\u002Fsigning-keys","2.guide\u002F4.going-further\u002F3.signing-keys","i-lucide-key-square",{"title":146,"path":147,"stem":148,"icon":149},"Stripe setup","\u002Fguide\u002Fgoing-further\u002Fstripe-setup","2.guide\u002F4.going-further\u002F4.stripe-setup","i-lucide-credit-card",{"title":151,"path":152,"stem":153,"icon":154},"Migrate to the permission model","\u002Fguide\u002Fgoing-further\u002Fmigrate-access-control","2.guide\u002F4.going-further\u002F5.migrate-access-control","i-lucide-arrow-right-left",{"title":156,"icon":157,"path":158,"stem":159,"children":160},"Modules","i-lucide-boxes","\u002Fmodules","3.modules",[161,163,244,273,320,375],{"title":156,"path":158,"stem":162},"3.modules\u002Findex",{"title":81,"icon":49,"path":164,"stem":165,"children":166,"page":49},"\u002Fmodules\u002Fidentity","3.modules\u002F1.identity",[167,190,194,198,220,224,240],{"title":168,"path":169,"stem":170,"children":171},"Auth","\u002Fmodules\u002Fidentity\u002Fauth","3.modules\u002F1.identity\u002F1.auth\u002Findex",[172,174,178,182,186],{"title":173,"path":169,"stem":170},"Overview",{"title":175,"path":176,"stem":177},"Server API","\u002Fmodules\u002Fidentity\u002Fauth\u002Fserver","3.modules\u002F1.identity\u002F1.auth\u002F2.server",{"title":179,"path":180,"stem":181},"Reference","\u002Fmodules\u002Fidentity\u002Fauth\u002Freference","3.modules\u002F1.identity\u002F1.auth\u002F3.reference",{"title":183,"path":184,"stem":185},"Client mode","\u002Fmodules\u002Fidentity\u002Fauth\u002Fclient-mode","3.modules\u002F1.identity\u002F1.auth\u002F4.client-mode",{"title":187,"path":188,"stem":189},"OAuth providers","\u002Fmodules\u002Fidentity\u002Fauth\u002Foauth-providers","3.modules\u002F1.identity\u002F1.auth\u002F5.oauth-providers",{"title":191,"path":192,"stem":193},"Users","\u002Fmodules\u002Fidentity\u002Fusers","3.modules\u002F1.identity\u002F2.users",{"title":195,"path":196,"stem":197},"Account","\u002Fmodules\u002Fidentity\u002Faccount","3.modules\u002F1.identity\u002F3.account",{"title":199,"path":200,"stem":201,"children":202},"Authorization","\u002Fmodules\u002Fidentity\u002Fauthorization","3.modules\u002F1.identity\u002F4.authorization\u002Findex",[203,204,208,212,216],{"title":173,"path":200,"stem":201},{"title":205,"path":206,"stem":207},"Roles and requirements","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Froles-and-requirements","3.modules\u002F1.identity\u002F4.authorization\u002F2.roles-and-requirements",{"title":209,"path":210,"stem":211},"Policies","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fpolicies","3.modules\u002F1.identity\u002F4.authorization\u002F3.policies",{"title":213,"path":214,"stem":215},"Client","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fclient","3.modules\u002F1.identity\u002F4.authorization\u002F4.client",{"title":217,"path":218,"stem":219},"Admin","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fadmin","3.modules\u002F1.identity\u002F4.authorization\u002F5.admin",{"title":221,"path":222,"stem":223},"Preferences","\u002Fmodules\u002Fidentity\u002Fpreferences","3.modules\u002F1.identity\u002F5.preferences",{"title":225,"path":226,"stem":227,"children":228},"OAuth Server","\u002Fmodules\u002Fidentity\u002Foauth-server","3.modules\u002F1.identity\u002F6.oauth-server\u002Findex",[229,230,233,237],{"title":173,"path":226,"stem":227},{"title":175,"path":231,"stem":232},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fserver","3.modules\u002F1.identity\u002F6.oauth-server\u002F2.server",{"title":234,"path":235,"stem":236},"Hooks","\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fhooks","3.modules\u002F1.identity\u002F6.oauth-server\u002F3.hooks",{"title":179,"path":238,"stem":239},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Froutes-and-clients","3.modules\u002F1.identity\u002F6.oauth-server\u002F4.routes-and-clients",{"title":241,"path":242,"stem":243},"OAuth Resource","\u002Fmodules\u002Fidentity\u002Foauth-resource","3.modules\u002F1.identity\u002F8.oauth-resource",{"title":245,"icon":49,"path":246,"stem":247,"children":248,"page":49},"Commerce","\u002Fmodules\u002Fcommerce","3.modules\u002F2.commerce",[249,253,257],{"title":250,"path":251,"stem":252},"Stripe","\u002Fmodules\u002Fcommerce\u002Fstripe","3.modules\u002F2.commerce\u002F1.stripe",{"title":254,"path":255,"stem":256},"Payments","\u002Fmodules\u002Fcommerce\u002Fpayments","3.modules\u002F2.commerce\u002F2.payments",{"title":258,"path":259,"stem":260,"children":261},"Subscriptions","\u002Fmodules\u002Fcommerce\u002Fsubscriptions","3.modules\u002F2.commerce\u002F3.subscriptions\u002Findex",[262,263,266,270],{"title":173,"path":259,"stem":260},{"title":175,"path":264,"stem":265},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fserver","3.modules\u002F2.commerce\u002F3.subscriptions\u002F2.server",{"title":267,"path":268,"stem":269},"App","\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fapp","3.modules\u002F2.commerce\u002F3.subscriptions\u002F3.app",{"title":179,"path":271,"stem":272},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Freference","3.modules\u002F2.commerce\u002F3.subscriptions\u002F4.reference",{"title":274,"icon":49,"path":275,"stem":276,"children":277,"page":49},"Features","\u002Fmodules\u002Ffeatures","3.modules\u002F3.features",[278,293,312,316],{"title":279,"path":280,"stem":281,"children":282},"Events","\u002Fmodules\u002Ffeatures\u002Fevents","3.modules\u002F3.features\u002F1.events\u002Findex",[283,284,287,290],{"title":173,"path":280,"stem":281},{"title":175,"path":285,"stem":286},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fserver","3.modules\u002F3.features\u002F1.events\u002F2.server",{"title":267,"path":288,"stem":289},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fapp","3.modules\u002F3.features\u002F1.events\u002F3.app",{"title":179,"path":291,"stem":292},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Freference","3.modules\u002F3.features\u002F1.events\u002F4.reference",{"title":294,"path":295,"stem":296,"children":297},"Forms","\u002Fmodules\u002Ffeatures\u002Fforms","3.modules\u002F3.features\u002F2.forms\u002Findex",[298,299,303,306,309],{"title":173,"path":295,"stem":296},{"title":300,"path":301,"stem":302},"Definition","\u002Fmodules\u002Ffeatures\u002Fforms\u002Fdefinition","3.modules\u002F3.features\u002F2.forms\u002F2.definition",{"title":175,"path":304,"stem":305},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fserver","3.modules\u002F3.features\u002F2.forms\u002F3.server",{"title":267,"path":307,"stem":308},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fapp","3.modules\u002F3.features\u002F2.forms\u002F4.app",{"title":179,"path":310,"stem":311},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Freference","3.modules\u002F3.features\u002F2.forms\u002F5.reference",{"title":313,"path":314,"stem":315},"Cookie Consent","\u002Fmodules\u002Ffeatures\u002Fcookie-consent","3.modules\u002F3.features\u002F3.cookie-consent",{"title":317,"path":318,"stem":319},"MCP","\u002Fmodules\u002Ffeatures\u002Fmcp","3.modules\u002F3.features\u002F4.mcp",{"title":321,"icon":49,"path":322,"stem":323,"children":324,"page":49},"Interface","\u002Fmodules\u002Finterface","3.modules\u002F4.interface",[325,350,353,357,361],{"title":326,"path":327,"stem":328,"children":329},"UI","\u002Fmodules\u002Finterface\u002Fui","3.modules\u002F4.interface\u002F1.ui\u002Findex",[330,331,335,339,343,347],{"title":173,"path":327,"stem":328},{"title":332,"path":333,"stem":334},"Page components","\u002Fmodules\u002Finterface\u002Fui\u002Fpage-components","3.modules\u002F4.interface\u002F1.ui\u002F2.page-components",{"title":336,"path":337,"stem":338},"App shell","\u002Fmodules\u002Finterface\u002Fui\u002Fapp-shell","3.modules\u002F4.interface\u002F1.ui\u002F3.app-shell",{"title":340,"path":341,"stem":342},"Form inputs","\u002Fmodules\u002Finterface\u002Fui\u002Fform-inputs","3.modules\u002F4.interface\u002F1.ui\u002F4.form-inputs",{"title":344,"path":345,"stem":346},"Composables and helpers","\u002Fmodules\u002Finterface\u002Fui\u002Fcomposables","3.modules\u002F4.interface\u002F1.ui\u002F5.composables",{"title":179,"path":348,"stem":349},"\u002Fmodules\u002Finterface\u002Fui\u002Freference","3.modules\u002F4.interface\u002F1.ui\u002F6.reference",{"title":217,"path":351,"stem":352},"\u002Fmodules\u002Finterface\u002Fadmin","3.modules\u002F4.interface\u002F2.admin",{"title":354,"path":355,"stem":356},"Menu","\u002Fmodules\u002Finterface\u002Fmenu","3.modules\u002F4.interface\u002F3.menu",{"title":358,"path":359,"stem":360},"Widget","\u002Fmodules\u002Finterface\u002Fwidget","3.modules\u002F4.interface\u002F4.widget",{"title":362,"path":363,"stem":364,"children":365},"Mobile","\u002Fmodules\u002Finterface\u002Fmobile","3.modules\u002F4.interface\u002F5.mobile\u002Findex",[366,367,371],{"title":173,"path":363,"stem":364},{"title":368,"path":369,"stem":370},"CLI and devices","\u002Fmodules\u002Finterface\u002Fmobile\u002Fcli-and-devices","3.modules\u002F4.interface\u002F5.mobile\u002F2.cli-and-devices",{"title":372,"path":373,"stem":374},"Splash screen","\u002Fmodules\u002Finterface\u002Fmobile\u002Fsplash-screen","3.modules\u002F4.interface\u002F5.mobile\u002F3.splash-screen",{"title":376,"icon":49,"path":377,"stem":378,"children":379,"page":49},"Platform","\u002Fmodules\u002Fplatform","3.modules\u002F5.platform",[380,402,406,423],{"title":381,"path":382,"stem":383,"children":384},"Module Kit","\u002Fmodules\u002Fplatform\u002Fmodule-kit","3.modules\u002F5.platform\u002F1.module-kit\u002Findex",[385,386,390,394,398],{"title":173,"path":382,"stem":383},{"title":387,"path":388,"stem":389},"Server toolkit","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fserver-toolkit","3.modules\u002F5.platform\u002F1.module-kit\u002F2.server-toolkit",{"title":391,"path":392,"stem":393},"Registries and menus","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fregistries-and-menus","3.modules\u002F5.platform\u002F1.module-kit\u002F3.registries-and-menus",{"title":395,"path":396,"stem":397},"Translations","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fi18n","3.modules\u002F5.platform\u002F1.module-kit\u002F4.i18n",{"title":399,"path":400,"stem":401},"Database helpers","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fdatabase","3.modules\u002F5.platform\u002F1.module-kit\u002F5.database",{"title":403,"path":404,"stem":405},"Notify","\u002Fmodules\u002Fplatform\u002Fnotify","3.modules\u002F5.platform\u002F2.notify",{"title":407,"path":408,"stem":409,"children":410},"Email Templates","\u002Fmodules\u002Fplatform\u002Femail-templates","3.modules\u002F5.platform\u002F3.email-templates\u002Findex",[411,412,416,419],{"title":173,"path":408,"stem":409},{"title":413,"path":414,"stem":415},"Email components","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fcomponents","3.modules\u002F5.platform\u002F3.email-templates\u002F2.components",{"title":175,"path":417,"stem":418},"\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fserver","3.modules\u002F5.platform\u002F3.email-templates\u002F3.server",{"title":420,"path":421,"stem":422},"Module emails","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fmodule-emails","3.modules\u002F5.platform\u002F3.email-templates\u002F4.module-emails",{"title":424,"path":425,"stem":426,"children":427},"Base Layer","\u002Fmodules\u002Fplatform\u002Fbase-layer","3.modules\u002F5.platform\u002F4.base-layer\u002Findex",[428,429,433,437],{"title":173,"path":425,"stem":426},{"title":430,"path":431,"stem":432},"Content collections","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcontent-collections","3.modules\u002F5.platform\u002F4.base-layer\u002F2.content-collections",{"title":434,"path":435,"stem":436},"Layouts and routing","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Flayouts-and-routing","3.modules\u002F5.platform\u002F4.base-layer\u002F3.layouts-and-routing",{"title":438,"path":439,"stem":440},"Composables and utils","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcomposables-and-utils","3.modules\u002F5.platform\u002F4.base-layer\u002F4.composables-and-utils",{"title":442,"icon":443,"path":444,"stem":445,"children":446,"page":49},"Examples","i-lucide-code-xml","\u002Fexamples","4.examples",[447,466,476],{"title":448,"icon":49,"path":449,"stem":450,"children":451,"page":49},"Starters","\u002Fexamples\u002Fstarters","4.examples\u002F1.starters",[452,456,461],{"title":453,"path":454,"stem":455,"icon":6},"Workspace starter","\u002Fexamples\u002Fstarters\u002Fworkspace","4.examples\u002F1.starters\u002F1.workspace",{"title":457,"path":458,"stem":459,"icon":460},"Mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile","4.examples\u002F1.starters\u002F2.mobile","i-lucide-smartphone",{"title":462,"path":463,"stem":464,"icon":465},"Standalone mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile-standalone","4.examples\u002F1.starters\u002F3.mobile-standalone","i-lucide-tablet-smartphone",{"title":467,"icon":49,"path":468,"stem":469,"children":470,"page":49},"Apps","\u002Fexamples\u002Fapps","4.examples\u002F2.apps",[471],{"title":472,"path":473,"stem":474,"icon":475},"Frigear website app","\u002Fexamples\u002Fapps\u002Ffrigear-nu-website","4.examples\u002F2.apps\u002F1.frigear-nu-website","i-lucide-layout-dashboard",{"title":477,"icon":49,"path":478,"stem":479,"children":480,"page":49},"Tasks","\u002Fexamples\u002Ftasks","4.examples\u002F3.tasks",[481,485,489,494,499],{"title":482,"path":483,"stem":484,"icon":70},"Protect a route","\u002Fexamples\u002Ftasks\u002Fprotect-a-route","4.examples\u002F3.tasks\u002F1.protect-a-route",{"title":486,"path":487,"stem":488,"icon":475},"Add an admin page","\u002Fexamples\u002Ftasks\u002Fadd-an-admin-page","4.examples\u002F3.tasks\u002F2.add-an-admin-page",{"title":490,"path":491,"stem":492,"icon":493},"Sell event tickets","\u002Fexamples\u002Ftasks\u002Fsell-event-tickets","4.examples\u002F3.tasks\u002F3.sell-event-tickets","i-lucide-ticket",{"title":495,"path":496,"stem":497,"icon":498},"Build a form","\u002Fexamples\u002Ftasks\u002Fbuild-a-form","4.examples\u002F3.tasks\u002F4.build-a-form","i-lucide-clipboard-list",{"title":500,"path":501,"stem":502,"icon":503},"Send an email","\u002Fexamples\u002Ftasks\u002Fsend-an-email","4.examples\u002F3.tasks\u002F5.send-an-email","i-lucide-mail",{"title":505,"icon":506,"path":507,"stem":508,"children":509,"page":49},"Contribute","i-lucide-git-pull-request","\u002Fcontribute","5.contribute",[510,513,518,544,549,552,556,571],{"title":173,"path":511,"stem":512,"icon":506},"\u002Fcontribute\u002Foverview","5.contribute\u002F1.overview",{"title":514,"path":515,"stem":516,"icon":517},"Local development","\u002Fcontribute\u002Flocal-development","5.contribute\u002F2.local-development","i-lucide-terminal",{"title":519,"icon":49,"path":520,"stem":521,"children":522,"page":49},"Writing a module","\u002Fcontribute\u002Fwriting-a-module","5.contribute\u002F3.writing-a-module",[523,527,532,536,541],{"title":524,"path":525,"stem":526,"icon":39},"Scaffold a module","\u002Fcontribute\u002Fwriting-a-module\u002Fscaffold","5.contribute\u002F3.writing-a-module\u002F1.scaffold",{"title":528,"path":529,"stem":530,"icon":531},"Setup checklist","\u002Fcontribute\u002Fwriting-a-module\u002Fsetup-checklist","5.contribute\u002F3.writing-a-module\u002F2.setup-checklist","i-lucide-list-checks",{"title":533,"path":534,"stem":535,"icon":44},"Database tables","\u002Fcontribute\u002Fwriting-a-module\u002Fdatabase-tables","5.contribute\u002F3.writing-a-module\u002F3.database-tables",{"title":537,"path":538,"stem":539,"icon":540},"Testing","\u002Fcontribute\u002Fwriting-a-module\u002Ftesting","5.contribute\u002F3.writing-a-module\u002F4.testing","i-lucide-flask-conical",{"title":67,"path":542,"stem":543,"icon":70},"\u002Fcontribute\u002Fwriting-a-module\u002Faccess-control","5.contribute\u002F3.writing-a-module\u002F5.access-control",{"title":545,"path":546,"stem":547,"icon":548},"Publishing","\u002Fcontribute\u002Fpublishing","5.contribute\u002F4.publishing","i-lucide-package-check",{"title":448,"path":550,"stem":551,"icon":6},"\u002Fcontribute\u002Fstarters","5.contribute\u002F5.starters",{"title":553,"path":554,"stem":555,"icon":52},"Documentation","\u002Fcontribute\u002Fdocumentation","5.contribute\u002F6.documentation",{"title":557,"icon":49,"path":558,"stem":559,"children":560,"page":49},"Tooling","\u002Fcontribute\u002Ftooling","5.contribute\u002F7.tooling",[561,566],{"title":562,"path":563,"stem":564,"icon":565},"CLI","\u002Fcontribute\u002Ftooling\u002Fcli","5.contribute\u002F7.tooling\u002F1.cli","i-lucide-square-terminal",{"title":567,"path":568,"stem":569,"icon":570},"ESLint config","\u002Fcontribute\u002Ftooling\u002Feslint-config","5.contribute\u002F7.tooling\u002F2.eslint-config","i-lucide-spell-check",{"title":572,"icon":49,"path":573,"stem":574,"children":575},"Decisions","\u002Fcontribute\u002Fdecisions","5.contribute\u002F8.decisions\u002Findex",[576,578,583],{"title":572,"path":573,"stem":574,"icon":577},"i-lucide-scale",{"title":579,"path":580,"stem":581,"icon":582},"Session lifetimes per OAuth client","\u002Fcontribute\u002Fdecisions\u002Foauth-token-lifetimes","5.contribute\u002F8.decisions\u002F1.oauth-token-lifetimes","i-lucide-timer",{"title":584,"path":585,"stem":586,"icon":70},"One permission model","\u002Fcontribute\u002Fdecisions\u002Fpermission-model","5.contribute\u002F8.decisions\u002F2.permission-model",{"id":588,"title":31,"body":589,"description":2090,"extension":2091,"links":2092,"meta":2093,"navigation":2094,"path":32,"seo":2095,"stem":33,"__hash__":2096},"docs\u002F1.get-started\u002F5.authentication.md",{"type":590,"value":591,"toc":2082},"minimark",[592,599,621,629,634,641,657,661,672,760,903,963,973,979,983,1000,1096,1113,1214,1224,1242,1253,1257,1267,1363,1378,1385,1457,1472,1485,1489,1503,1644,1671,2045,2051,2055,2078],[593,594,595],"p",{},[596,597,598],"strong",{},"What you'll have afterwards:",[600,601,602,606,614],"ul",{},[603,604,605],"li",{},"The sign-in methods you want, such as password, emailed link or passkeys.",[603,607,608,609,613],{},"Server routes that only a ",[610,611,612],"a",{"href":87},"signed-in user"," can call.",[603,615,616,617,620],{},"Pages that a ",[610,618,619],{"href":87},"visitor"," is sent away from, to the sign-in page.",[593,622,623,625,626,628],{},[610,624,168],{"href":169}," lets people sign in and tells every server route who is calling.\n",[610,627,191],{"href":192}," installs Auth for you and stores the users.",[630,631,633],"h2",{"id":632},"prerequisites","Prerequisites",[593,635,636,637,640],{},"A project created in ",[610,638,16],{"href":639},"\u002Fget-started\u002Finstallation#_1-create-the-project",".",[642,643,644,645,649,650,653,654,656],"warning",{},"The config key of Auth is ",[646,647,648],"code",{},"authentication",", not ",[646,651,652],{},"auth",". The ",[646,655,652],{}," key belongs to nuxt-auth-utils.",[630,658,660],{"id":659},"_1-choose-the-sign-in-methods","1. Choose the sign-in methods",[593,662,663,664,667,668,671],{},"Turn methods on under ",[646,665,666],{},"authentication.settings"," in ",[646,669,670],{},"nuxt.config.ts",":",[673,674,675,691],"table",{},[676,677,678],"thead",{},[679,680,681,685,688],"tr",{},[682,683,684],"th",{},"Method",[682,686,687],{},"Option",[682,689,690],{},"Default",[692,693,694,715,728,747],"tbody",{},[679,695,696,700,705],{},[697,698,699],"td",{},"Email and password",[697,701,702],{},[646,703,704],{},"password",[697,706,707,710,711,714],{},[646,708,709],{},"true"," (",[646,712,713],{},"passwordReset"," follows it)",[679,716,717,720,725],{},[697,718,719],{},"Magic link (emailed, single use)",[697,721,722],{},[646,723,724],{},"magicLink",[697,726,727],{},"off",[679,729,730,733,738],{},[697,731,732],{},"Passkeys",[697,734,735],{},[646,736,737],{},"webAuthn",[697,739,740,743,744,746],{},[646,741,742],{},"false"," (the starters set ",[646,745,709],{},")",[679,748,749,754,757],{},[697,750,751,753],{},[610,752,187],{"href":87}," (GitHub, Google, any OpenID Connect server, ...)",[697,755,756],{},"credentials in environment variables",[697,758,759],{},"off until configured",[761,762,768],"pre",{"className":763,"code":764,"filename":765,"language":766,"meta":767,"style":767},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","export default defineNuxtConfig({\n  authentication: {\n    settings: {\n      afterLogin: '\u002Faccount',\n      pages: { login: true, register: true },\n      magicLink: true,\n    },\n  },\n})\n","apps\u002Fweb\u002Fnuxt.config.ts","ts","",[646,769,770,794,806,816,837,870,882,888,894],{"__ignoreMap":767},[771,772,775,779,782,786,790],"span",{"class":773,"line":774},"line",1,[771,776,778],{"class":777},"s7zQu","export",[771,780,781],{"class":777}," default",[771,783,785],{"class":784},"s2Zo4"," defineNuxtConfig",[771,787,789],{"class":788},"sTEyZ","(",[771,791,793],{"class":792},"sMK4o","{\n",[771,795,797,801,803],{"class":773,"line":796},2,[771,798,800],{"class":799},"swJcz","  authentication",[771,802,671],{"class":792},[771,804,805],{"class":792}," {\n",[771,807,809,812,814],{"class":773,"line":808},3,[771,810,811],{"class":799},"    settings",[771,813,671],{"class":792},[771,815,805],{"class":792},[771,817,819,822,824,827,831,834],{"class":773,"line":818},4,[771,820,821],{"class":799},"      afterLogin",[771,823,671],{"class":792},[771,825,826],{"class":792}," '",[771,828,830],{"class":829},"sfazB","\u002Faccount",[771,832,833],{"class":792},"'",[771,835,836],{"class":792},",\n",[771,838,840,843,845,848,851,853,857,860,863,865,867],{"class":773,"line":839},5,[771,841,842],{"class":799},"      pages",[771,844,671],{"class":792},[771,846,847],{"class":792}," {",[771,849,850],{"class":799}," login",[771,852,671],{"class":792},[771,854,856],{"class":855},"sfNiH"," true",[771,858,859],{"class":792},",",[771,861,862],{"class":799}," register",[771,864,671],{"class":792},[771,866,856],{"class":855},[771,868,869],{"class":792}," },\n",[771,871,873,876,878,880],{"class":773,"line":872},6,[771,874,875],{"class":799},"      magicLink",[771,877,671],{"class":792},[771,879,856],{"class":855},[771,881,836],{"class":792},[771,883,885],{"class":773,"line":884},7,[771,886,887],{"class":792},"    },\n",[771,889,891],{"class":773,"line":890},8,[771,892,893],{"class":792},"  },\n",[771,895,897,900],{"class":773,"line":896},9,[771,898,899],{"class":792},"}",[771,901,902],{"class":788},")\n",[600,904,905,922,932,946,956],{},[603,906,907,910,911,914,915,910,918,921],{},[646,908,909],{},"pages.login"," and ",[646,912,913],{},"pages.register"," add the ",[646,916,917],{},"\u002Flogin",[646,919,920],{},"\u002Fregister"," pages.",[603,923,924,927,928,931],{},[646,925,926],{},"afterLogin"," is where users land after signing in, unless a ",[646,929,930],{},"?redirect="," was requested.",[603,933,934,935,910,938,941,942,945],{},"Passkeys need ",[646,936,937],{},"@simplewebauthn\u002Fserver",[646,939,940],{},"@simplewebauthn\u002Fbrowser"," installed in the app. Users add a passkey on\n",[646,943,944],{},"\u002Faccount\u002Fsecurity",", and the sign-in page then shows a passkey button.",[603,947,948,949,952,953,640],{},"An OAuth provider turns on once its nuxt-auth-utils credentials exist, for example ",[646,950,951],{},"NUXT_OAUTH_OIDC_CLIENT_ID",".\nWithout credentials its route answers ",[646,954,955],{},"404",[603,957,958,959,962],{},"Register ",[646,960,961],{},"\u003Corigin>\u002Fapi\u002Fauth\u002F\u003Cprovider>"," as the callback URL at the OAuth provider.",[642,964,965,966,968,969,972],{},"Magic links and password resets are emailed. Configure a ",[610,967,403],{"href":404}," driver before you rely on\nthem. Until then the ",[646,970,971],{},"log"," driver prints them in the terminal.",[593,974,975,976,978],{},"The full list of options is on the ",[610,977,168],{"href":169}," page.",[630,980,982],{"id":981},"_2-protect-a-server-route","2. Protect a server route",[593,984,985,988,989,992,993,996,997,640],{},[646,986,987],{},"authorize"," checks that a request comes from a signed-in user who may do one thing, a\n",[610,990,991],{"href":87},"permission"," such as ",[646,994,995],{},"tickets:read",", and returns who it is. It is auto-imported in server\ncode. Use it instead of nuxt-auth-utils' ",[646,998,999],{},"requireUserSession",[761,1001,1004],{"className":763,"code":1002,"filename":1003,"language":766,"meta":767,"style":767},"export default defineEventHandler(async (event) => {\n  const { user } = await authorize(event, 'tickets:read')\n  return getTickets(user.id)\n})\n","server\u002Fapi\u002Ftickets.get.ts",[646,1005,1006,1034,1070,1090],{"__ignoreMap":767},[771,1007,1008,1010,1012,1015,1017,1021,1023,1027,1029,1032],{"class":773,"line":774},[771,1009,778],{"class":777},[771,1011,781],{"class":777},[771,1013,1014],{"class":784}," defineEventHandler",[771,1016,789],{"class":788},[771,1018,1020],{"class":1019},"spNyl","async",[771,1022,710],{"class":792},[771,1024,1026],{"class":1025},"sHdIc","event",[771,1028,746],{"class":792},[771,1030,1031],{"class":1019}," =>",[771,1033,805],{"class":792},[771,1035,1036,1039,1041,1044,1047,1050,1053,1056,1058,1060,1062,1064,1066,1068],{"class":773,"line":796},[771,1037,1038],{"class":1019},"  const",[771,1040,847],{"class":792},[771,1042,1043],{"class":788}," user",[771,1045,1046],{"class":792}," }",[771,1048,1049],{"class":792}," =",[771,1051,1052],{"class":777}," await",[771,1054,1055],{"class":784}," authorize",[771,1057,789],{"class":799},[771,1059,1026],{"class":788},[771,1061,859],{"class":792},[771,1063,826],{"class":792},[771,1065,995],{"class":829},[771,1067,833],{"class":792},[771,1069,902],{"class":799},[771,1071,1072,1075,1078,1080,1083,1085,1088],{"class":773,"line":808},[771,1073,1074],{"class":777},"  return",[771,1076,1077],{"class":784}," getTickets",[771,1079,789],{"class":799},[771,1081,1082],{"class":788},"user",[771,1084,640],{"class":792},[771,1086,1087],{"class":788},"id",[771,1089,902],{"class":799},[771,1091,1092,1094],{"class":773,"line":818},[771,1093,899],{"class":792},[771,1095,902],{"class":788},[1097,1098,1099,1100,1103,1104,1107,1108,1112],"note",{},"A request can prove who it is with a cookie session, an ",[610,1101,1102],{"href":87},"API token"," or an\n",[610,1105,1106],{"href":87},"access token",". Auth turns all three into one answer, the\n",[610,1109,1111],{"href":1110},"\u002Fguide\u002Fconcepts\u002Fauth-and-scopes#the-principal","principal",". What a session may do comes from the user's roles. A token\nholds only the permissions it was given, within its user's.",[673,1114,1115,1125],{},[676,1116,1117],{},[679,1118,1119,1122],{},[682,1120,1121],{},"Call",[682,1123,1124],{},"Behaviour",[692,1126,1127,1149,1163,1173,1186,1200],{},[679,1128,1129,1134],{},[697,1130,1131],{},[646,1132,1133],{},"authorize(event, permission)",[697,1135,1136,1137,1140,1141,1144,1145,1148],{},"The principal, when it holds the permission. ",[646,1138,1139],{},"401"," without a valid credential, ",[646,1142,1143],{},"403 insufficient_scope"," for a token without it, ",[646,1146,1147],{},"403 forbidden"," for a user without it.",[679,1150,1151,1156],{},[697,1152,1153],{},[646,1154,1155],{},"authorize(event, permission, record)",[697,1157,1158,1159,1162],{},"Also runs the ",[610,1160,1161],{"href":210},"policies"," of the permission against the record.",[679,1164,1165,1170],{},[697,1166,1167],{},[646,1168,1169],{},"allows(event, permission, record?)",[697,1171,1172],{},"The same decision as a boolean. Never throws.",[679,1174,1175,1180],{},[697,1176,1177],{},[646,1178,1179],{},"requireAuth(event)",[697,1181,1182,1183,1185],{},"The principal from any credential, for routes every signed-in user may call. ",[646,1184,1139],{}," without a valid one.",[679,1187,1188,1193],{},[697,1189,1190],{},[646,1191,1192],{},"requireAuth(event, { sessionOnly: true })",[697,1194,1195,1196,1199],{},"Cookie sessions only. ",[646,1197,1198],{},"403 session_required"," for tokens.",[679,1201,1202,1207],{},[697,1203,1204],{},[646,1205,1206],{},"getAuth(event)",[697,1208,1209,1210,1213],{},"The principal or ",[646,1211,1212],{},"null",". Never throws.",[593,1215,1216,1217,1220,1221,1223],{},"When you only need the user, ",[646,1218,1219],{},"requireUser(event, options)"," from ",[610,1222,191],{"href":192}," returns just the user.",[1225,1226,1227,1228,1231,1232,1234,1235,1237,1238,1241],"caution",{},"Anything that changes who the user is or how they sign in (password, email, passkeys, API tokens), moves money or mints\ncredentials is a ",[646,1229,1230],{},"sessionOnly"," permission: ",[646,1233,987],{}," answers ",[646,1236,1198],{}," to a token. A leaked token must\nnot be able to do that. ",[610,1239,1230],{"href":1240},"\u002Fguide\u002Fconcepts\u002Fauth-and-scopes#sessiononly"," explains the rule.",[593,1243,1244,1245,1248,1249,1252],{},"A permission has to be registered (modules do it for theirs with ",[646,1246,1247],{},"addPermission","). An unregistered name is a ",[646,1250,1251],{},"403"," for\neveryone.",[630,1254,1256],{"id":1255},"_3-protect-a-page","3. Protect a page",[593,1258,1259,1261,1262,667,1265,671],{},[610,1260,199],{"href":200}," decides who may open a page. The starter installs it. Add a rule to\n",[646,1263,1264],{},"routeRules",[646,1266,670],{},[761,1268,1270],{"className":763,"code":1269,"filename":765,"language":766,"meta":767,"style":767},"export default defineNuxtConfig({\n  routeRules: {\n    '\u002Fmembers\u002F**': { authenticated: true },\n    '\u002Fadmin\u002F**': { permission: 'admin:access', ssr: false },\n  },\n})\n",[646,1271,1272,1284,1293,1316,1353,1357],{"__ignoreMap":767},[771,1273,1274,1276,1278,1280,1282],{"class":773,"line":774},[771,1275,778],{"class":777},[771,1277,781],{"class":777},[771,1279,785],{"class":784},[771,1281,789],{"class":788},[771,1283,793],{"class":792},[771,1285,1286,1289,1291],{"class":773,"line":796},[771,1287,1288],{"class":799},"  routeRules",[771,1290,671],{"class":792},[771,1292,805],{"class":792},[771,1294,1295,1298,1301,1303,1305,1307,1310,1312,1314],{"class":773,"line":808},[771,1296,1297],{"class":792},"    '",[771,1299,1300],{"class":799},"\u002Fmembers\u002F**",[771,1302,833],{"class":792},[771,1304,671],{"class":792},[771,1306,847],{"class":792},[771,1308,1309],{"class":799}," authenticated",[771,1311,671],{"class":792},[771,1313,856],{"class":855},[771,1315,869],{"class":792},[771,1317,1318,1320,1323,1325,1327,1329,1332,1334,1336,1339,1341,1343,1346,1348,1351],{"class":773,"line":818},[771,1319,1297],{"class":792},[771,1321,1322],{"class":799},"\u002Fadmin\u002F**",[771,1324,833],{"class":792},[771,1326,671],{"class":792},[771,1328,847],{"class":792},[771,1330,1331],{"class":799}," permission",[771,1333,671],{"class":792},[771,1335,826],{"class":792},[771,1337,1338],{"class":829},"admin:access",[771,1340,833],{"class":792},[771,1342,859],{"class":792},[771,1344,1345],{"class":799}," ssr",[771,1347,671],{"class":792},[771,1349,1350],{"class":855}," false",[771,1352,869],{"class":792},[771,1354,1355],{"class":773,"line":839},[771,1356,893],{"class":792},[771,1358,1359,1361],{"class":773,"line":872},[771,1360,899],{"class":792},[771,1362,902],{"class":788},[593,1364,1365,1366,1369,1370,1372,1373,1375,1376,640],{},"A visitor is sent to ",[646,1367,1368],{},"authorization.redirectTo",", which is ",[646,1371,917],{}," in the starter. The requested page goes in\n",[646,1374,930],{},", and the visitor comes back after signing in. A user without the permission gets ",[646,1377,1251],{},[593,1379,1380,1381,1384],{},"For one page, use ",[646,1382,1383],{},"definePageMeta",". Its rule replaces the matching route rules:",[761,1386,1390],{"className":1387,"code":1388,"language":1389,"meta":767,"style":767},"language-vue shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u003Cscript setup lang=\"ts\">\ndefinePageMeta({ authorize: 'events:manage' }) \u002F\u002F a registered permission\n\u003C\u002Fscript>\n","vue",[646,1391,1392,1419,1448],{"__ignoreMap":767},[771,1393,1394,1397,1400,1403,1406,1409,1412,1414,1416],{"class":773,"line":774},[771,1395,1396],{"class":792},"\u003C",[771,1398,1399],{"class":799},"script",[771,1401,1402],{"class":1019}," setup",[771,1404,1405],{"class":1019}," lang",[771,1407,1408],{"class":792},"=",[771,1410,1411],{"class":792},"\"",[771,1413,766],{"class":829},[771,1415,1411],{"class":792},[771,1417,1418],{"class":792},">\n",[771,1420,1421,1423,1425,1428,1430,1432,1434,1437,1439,1441,1444],{"class":773,"line":796},[771,1422,1383],{"class":784},[771,1424,789],{"class":788},[771,1426,1427],{"class":792},"{",[771,1429,1055],{"class":799},[771,1431,671],{"class":792},[771,1433,826],{"class":792},[771,1435,1436],{"class":829},"events:manage",[771,1438,833],{"class":792},[771,1440,1046],{"class":792},[771,1442,1443],{"class":788},") ",[771,1445,1447],{"class":1446},"sHwdD","\u002F\u002F a registered permission\n",[771,1449,1450,1453,1455],{"class":773,"line":808},[771,1451,1452],{"class":792},"\u003C\u002F",[771,1454,1399],{"class":799},[771,1456,1418],{"class":792},[593,1458,1459,1460,1463,1464,1467,1468,1471],{},"Rules for ",[646,1461,1462],{},"\u002Fapi\u002F**"," are enforced too. So ",[646,1465,1466],{},"'\u002Fapi\u002Fadmin\u002F**': { permission: 'admin:access' }"," guards the\n",[610,1469,1470],{"href":87},"staff"," API of every module.",[1473,1474,1477,1480,1481,1484],"callout",{"color":1475,"icon":1476},"success","i-lucide-check",[596,1478,1479],{},"What you should see:"," a signed-out visit to a guarded page lands on ",[646,1482,1483],{},"\u002Flogin?redirect=…",". After signing in, you are\nback on the page.",[630,1486,1488],{"id":1487},"_4-roles-and-the-first-admin","4. Roles and the first admin",[593,1490,1491,1492,1495,1496,1499,1500,671],{},"A user holds ",[610,1493,1494],{"href":206},"roles",", and a role is a bundle of permissions.\nDefine them in ",[646,1497,1498],{},"authorization.roles","; every signed-in user holds the ",[646,1501,1502],{},"defaultRoles",[761,1504,1506],{"className":763,"code":1505,"filename":765,"language":766,"meta":767,"style":767},"export default defineNuxtConfig({\n  authorization: {\n    defaultRoles: ['user'],\n    roles: {\n      admin: { label: 'Admin', grant: ['*'] }, \u002F\u002F '*' covers every permission except sensitive (:pii) ones\n      user: { label: 'User' }, \u002F\u002F self-service permissions are implicit: every user holds them anyway\n    },\n  },\n})\n",[646,1507,1508,1520,1529,1550,1559,1604,1630,1634,1638],{"__ignoreMap":767},[771,1509,1510,1512,1514,1516,1518],{"class":773,"line":774},[771,1511,778],{"class":777},[771,1513,781],{"class":777},[771,1515,785],{"class":784},[771,1517,789],{"class":788},[771,1519,793],{"class":792},[771,1521,1522,1525,1527],{"class":773,"line":796},[771,1523,1524],{"class":799},"  authorization",[771,1526,671],{"class":792},[771,1528,805],{"class":792},[771,1530,1531,1534,1536,1539,1541,1543,1545,1548],{"class":773,"line":808},[771,1532,1533],{"class":799},"    defaultRoles",[771,1535,671],{"class":792},[771,1537,1538],{"class":788}," [",[771,1540,833],{"class":792},[771,1542,1082],{"class":829},[771,1544,833],{"class":792},[771,1546,1547],{"class":788},"]",[771,1549,836],{"class":792},[771,1551,1552,1555,1557],{"class":773,"line":818},[771,1553,1554],{"class":799},"    roles",[771,1556,671],{"class":792},[771,1558,805],{"class":792},[771,1560,1561,1564,1566,1568,1571,1573,1575,1577,1579,1581,1584,1586,1588,1590,1593,1595,1598,1601],{"class":773,"line":839},[771,1562,1563],{"class":799},"      admin",[771,1565,671],{"class":792},[771,1567,847],{"class":792},[771,1569,1570],{"class":799}," label",[771,1572,671],{"class":792},[771,1574,826],{"class":792},[771,1576,217],{"class":829},[771,1578,833],{"class":792},[771,1580,859],{"class":792},[771,1582,1583],{"class":799}," grant",[771,1585,671],{"class":792},[771,1587,1538],{"class":788},[771,1589,833],{"class":792},[771,1591,1592],{"class":829},"*",[771,1594,833],{"class":792},[771,1596,1597],{"class":788},"] ",[771,1599,1600],{"class":792},"},",[771,1602,1603],{"class":1446}," \u002F\u002F '*' covers every permission except sensitive (:pii) ones\n",[771,1605,1606,1609,1611,1613,1615,1617,1619,1622,1624,1627],{"class":773,"line":872},[771,1607,1608],{"class":799},"      user",[771,1610,671],{"class":792},[771,1612,847],{"class":792},[771,1614,1570],{"class":799},[771,1616,671],{"class":792},[771,1618,826],{"class":792},[771,1620,1621],{"class":829},"User",[771,1623,833],{"class":792},[771,1625,1626],{"class":792}," },",[771,1628,1629],{"class":1446}," \u002F\u002F self-service permissions are implicit: every user holds them anyway\n",[771,1631,1632],{"class":773,"line":884},[771,1633,887],{"class":792},[771,1635,1636],{"class":773,"line":890},[771,1637,893],{"class":792},[771,1639,1640,1642],{"class":773,"line":896},[771,1641,899],{"class":792},[771,1643,902],{"class":788},[593,1645,1646,1647,1650,1651,1654,1655,1658,1659,1662,1663,1666,1667,1670],{},"Admins assign roles on the user's page in the admin. The very first admin comes from the environment:\n",[646,1648,1649],{},"server\u002Fplugins\u002Fauthorization-roles.ts"," adds ",[646,1652,1653],{},"admin"," to every user whose email is in ",[646,1656,1657],{},"NUXT_ACL_ADMINS",", its access\ncontrol list (ACL), in the ",[646,1660,1661],{},"authorization:roles"," hook. Only once the address is verified (",[646,1664,1665],{},"emailVerifiedAt","): otherwise\nanyone could sign up with an address on the list and become admin. The starter turns on ",[646,1668,1669],{},"verifyEmail",", so the first\nadmin verifies through the emailed link.",[761,1672,1675],{"className":763,"code":1673,"filename":1674,"language":766,"meta":767,"style":767},"\u002F\u002F Loads the `authorization:roles` hook type (Nitro's server tsconfig does not include module types).\nimport type {} from '@frigear-nu\u002Fauth'\n\n\u002F\u002F Verified addresses in NUXT_ACL_ADMINS hold the `admin` role (`authorization.roles` in nuxt.config.ts). This bootstraps\n\u002F\u002F the first admin, who verifies through the emailed link and assigns every other role in the admin. Nothing is stored:\n\u002F\u002F removing an address removes the access. The user comes from `ctx.user`, never from the session on `ctx.event`.\nexport default defineNitroPlugin((nitro) => {\n  nitro.hooks.hook('authorization:roles', (ctx) => {\n    const admins = String(useRuntimeConfig().aclAdmins).split(',').map(email => email.trim().toLowerCase()).filter(Boolean)\n    \u002F\u002F The stored user: an unverified address counts for nothing, since anyone can sign up with it.\n    const user = ctx.user as { email?: string | null, emailVerifiedAt?: unknown }\n    if (user.emailVerifiedAt && user.email && admins.includes(user.email.toLowerCase()) && !ctx.roles.includes('admin')) {\n      ctx.roles.push('admin')\n    }\n  })\n})\n","apps\u002Fweb\u002Fserver\u002Fplugins\u002Fauthorization-roles.ts",[646,1676,1677,1682,1704,1710,1715,1720,1725,1747,1783,1868,1874,1923,1999,2024,2030,2038],{"__ignoreMap":767},[771,1678,1679],{"class":773,"line":774},[771,1680,1681],{"class":1446},"\u002F\u002F Loads the `authorization:roles` hook type (Nitro's server tsconfig does not include module types).\n",[771,1683,1684,1687,1690,1693,1696,1698,1701],{"class":773,"line":796},[771,1685,1686],{"class":777},"import",[771,1688,1689],{"class":777}," type",[771,1691,1692],{"class":792}," {}",[771,1694,1695],{"class":777}," from",[771,1697,826],{"class":792},[771,1699,1700],{"class":829},"@frigear-nu\u002Fauth",[771,1702,1703],{"class":792},"'\n",[771,1705,1706],{"class":773,"line":808},[771,1707,1709],{"emptyLinePlaceholder":1708},true,"\n",[771,1711,1712],{"class":773,"line":818},[771,1713,1714],{"class":1446},"\u002F\u002F Verified addresses in NUXT_ACL_ADMINS hold the `admin` role (`authorization.roles` in nuxt.config.ts). This bootstraps\n",[771,1716,1717],{"class":773,"line":839},[771,1718,1719],{"class":1446},"\u002F\u002F the first admin, who verifies through the emailed link and assigns every other role in the admin. Nothing is stored:\n",[771,1721,1722],{"class":773,"line":872},[771,1723,1724],{"class":1446},"\u002F\u002F removing an address removes the access. The user comes from `ctx.user`, never from the session on `ctx.event`.\n",[771,1726,1727,1729,1731,1734,1736,1738,1741,1743,1745],{"class":773,"line":884},[771,1728,778],{"class":777},[771,1730,781],{"class":777},[771,1732,1733],{"class":784}," defineNitroPlugin",[771,1735,789],{"class":788},[771,1737,789],{"class":792},[771,1739,1740],{"class":1025},"nitro",[771,1742,746],{"class":792},[771,1744,1031],{"class":1019},[771,1746,805],{"class":792},[771,1748,1749,1752,1754,1757,1759,1762,1764,1766,1768,1770,1772,1774,1777,1779,1781],{"class":773,"line":890},[771,1750,1751],{"class":788},"  nitro",[771,1753,640],{"class":792},[771,1755,1756],{"class":788},"hooks",[771,1758,640],{"class":792},[771,1760,1761],{"class":784},"hook",[771,1763,789],{"class":799},[771,1765,833],{"class":792},[771,1767,1661],{"class":829},[771,1769,833],{"class":792},[771,1771,859],{"class":792},[771,1773,710],{"class":792},[771,1775,1776],{"class":1025},"ctx",[771,1778,746],{"class":792},[771,1780,1031],{"class":1019},[771,1782,805],{"class":792},[771,1784,1785,1788,1791,1793,1796,1798,1801,1804,1806,1809,1811,1813,1816,1818,1820,1822,1824,1826,1828,1831,1833,1836,1838,1841,1843,1846,1848,1850,1853,1856,1858,1861,1863,1866],{"class":773,"line":896},[771,1786,1787],{"class":1019},"    const",[771,1789,1790],{"class":788}," admins",[771,1792,1049],{"class":792},[771,1794,1795],{"class":784}," String",[771,1797,789],{"class":799},[771,1799,1800],{"class":784},"useRuntimeConfig",[771,1802,1803],{"class":799},"()",[771,1805,640],{"class":792},[771,1807,1808],{"class":788},"aclAdmins",[771,1810,746],{"class":799},[771,1812,640],{"class":792},[771,1814,1815],{"class":784},"split",[771,1817,789],{"class":799},[771,1819,833],{"class":792},[771,1821,859],{"class":829},[771,1823,833],{"class":792},[771,1825,746],{"class":799},[771,1827,640],{"class":792},[771,1829,1830],{"class":784},"map",[771,1832,789],{"class":799},[771,1834,1835],{"class":1025},"email",[771,1837,1031],{"class":1019},[771,1839,1840],{"class":788}," email",[771,1842,640],{"class":792},[771,1844,1845],{"class":784},"trim",[771,1847,1803],{"class":799},[771,1849,640],{"class":792},[771,1851,1852],{"class":784},"toLowerCase",[771,1854,1855],{"class":799},"())",[771,1857,640],{"class":792},[771,1859,1860],{"class":784},"filter",[771,1862,789],{"class":799},[771,1864,1865],{"class":788},"Boolean",[771,1867,902],{"class":799},[771,1869,1871],{"class":773,"line":1870},10,[771,1872,1873],{"class":1446},"    \u002F\u002F The stored user: an unverified address counts for nothing, since anyone can sign up with it.\n",[771,1875,1877,1879,1881,1883,1886,1888,1890,1893,1895,1897,1900,1904,1907,1910,1912,1915,1917,1920],{"class":773,"line":1876},11,[771,1878,1787],{"class":1019},[771,1880,1043],{"class":788},[771,1882,1049],{"class":792},[771,1884,1885],{"class":788}," ctx",[771,1887,640],{"class":792},[771,1889,1082],{"class":788},[771,1891,1892],{"class":777}," as",[771,1894,847],{"class":792},[771,1896,1840],{"class":799},[771,1898,1899],{"class":792},"?:",[771,1901,1903],{"class":1902},"sBMFI"," string",[771,1905,1906],{"class":792}," |",[771,1908,1909],{"class":1902}," null",[771,1911,859],{"class":792},[771,1913,1914],{"class":799}," emailVerifiedAt",[771,1916,1899],{"class":792},[771,1918,1919],{"class":1902}," unknown",[771,1921,1922],{"class":792}," }\n",[771,1924,1926,1929,1931,1933,1935,1937,1940,1942,1944,1946,1948,1950,1952,1955,1957,1959,1961,1963,1965,1967,1970,1973,1976,1978,1980,1982,1984,1986,1988,1990,1992,1994,1997],{"class":773,"line":1925},12,[771,1927,1928],{"class":777},"    if",[771,1930,710],{"class":799},[771,1932,1082],{"class":788},[771,1934,640],{"class":792},[771,1936,1665],{"class":788},[771,1938,1939],{"class":792}," &&",[771,1941,1043],{"class":788},[771,1943,640],{"class":792},[771,1945,1835],{"class":788},[771,1947,1939],{"class":792},[771,1949,1790],{"class":788},[771,1951,640],{"class":792},[771,1953,1954],{"class":784},"includes",[771,1956,789],{"class":799},[771,1958,1082],{"class":788},[771,1960,640],{"class":792},[771,1962,1835],{"class":788},[771,1964,640],{"class":792},[771,1966,1852],{"class":784},[771,1968,1969],{"class":799},"()) ",[771,1971,1972],{"class":792},"&&",[771,1974,1975],{"class":792}," !",[771,1977,1776],{"class":788},[771,1979,640],{"class":792},[771,1981,1494],{"class":788},[771,1983,640],{"class":792},[771,1985,1954],{"class":784},[771,1987,789],{"class":799},[771,1989,833],{"class":792},[771,1991,1653],{"class":829},[771,1993,833],{"class":792},[771,1995,1996],{"class":799},")) ",[771,1998,793],{"class":792},[771,2000,2002,2005,2007,2009,2011,2014,2016,2018,2020,2022],{"class":773,"line":2001},13,[771,2003,2004],{"class":788},"      ctx",[771,2006,640],{"class":792},[771,2008,1494],{"class":788},[771,2010,640],{"class":792},[771,2012,2013],{"class":784},"push",[771,2015,789],{"class":799},[771,2017,833],{"class":792},[771,2019,1653],{"class":829},[771,2021,833],{"class":792},[771,2023,902],{"class":799},[771,2025,2027],{"class":773,"line":2026},14,[771,2028,2029],{"class":792},"    }\n",[771,2031,2033,2036],{"class":773,"line":2032},15,[771,2034,2035],{"class":792},"  }",[771,2037,902],{"class":799},[771,2039,2041,2043],{"class":773,"line":2040},16,[771,2042,899],{"class":792},[771,2044,902],{"class":788},[593,2046,2047,2048,640],{},"The role is not stored: removing the address removes the access at once. Check what a signed-in user may do with\n",[646,2049,2050],{},"GET \u002Fapi\u002Fauth\u002Fme\u002Faccess",[630,2052,2054],{"id":2053},"next-steps","Next steps",[600,2056,2057,2062,2067,2073],{},[603,2058,2059,2061],{},[610,2060,36],{"href":37}," – bring in forms, payments, events and the rest.",[603,2063,2064,2066],{},[610,2065,482],{"href":483}," – try route protection end to end.",[603,2068,2069,2072],{},[610,2070,2071],{"href":68},"Auth and scopes"," – understand principals, scopes and staff in depth.",[603,2074,2075,2077],{},[610,2076,199],{"href":200}," – look up route rules, roles and policies.",[2079,2080,2081],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}",{"title":767,"searchDepth":796,"depth":796,"links":2083},[2084,2085,2086,2087,2088,2089],{"id":632,"depth":796,"text":633},{"id":659,"depth":796,"text":660},{"id":981,"depth":796,"text":982},{"id":1255,"depth":796,"text":1256},{"id":1487,"depth":796,"text":1488},{"id":2053,"depth":796,"text":2054},"Let people sign in, and protect your own server routes and pages.","md",null,{},{"icon":34},{"title":31,"description":2090},"kHoS_hP-A1mXnu25dF0sj47HWWgzyp-RK4Q3sV2fa6E",[2098,2100],{"title":26,"path":27,"stem":28,"description":2099,"icon":29,"children":-1},"Configure the modules in nuxt.config.ts, and set secrets and runtime config through environment variables.",{"title":36,"path":37,"stem":38,"description":2101,"icon":39,"children":-1},"Find the module you need and add it to your app, with its options, policies and migration.",1794503144997]