[{"data":1,"prerenderedAt":2588},["ShallowReactive",2],{"navigation_docs":3,"-guide-going-further-migrate-access-control":587,"-guide-going-further-migrate-access-control-surround":2583},[4,50,155,441,504],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":49},"Get Started","i-lucide-rocket","\u002Fget-started","1.get-started",[10,15,20,25,30,35,40,45],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fget-started\u002Fintroduction","1.get-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Installation","\u002Fget-started\u002Finstallation","1.get-started\u002F2.installation","i-lucide-download",{"title":21,"path":22,"stem":23,"icon":24},"Project structure","\u002Fget-started\u002Fproject-structure","1.get-started\u002F3.project-structure","i-lucide-folder-tree",{"title":26,"path":27,"stem":28,"icon":29},"Configuration","\u002Fget-started\u002Fconfiguration","1.get-started\u002F4.configuration","i-lucide-settings",{"title":31,"path":32,"stem":33,"icon":34},"Authentication","\u002Fget-started\u002Fauthentication","1.get-started\u002F5.authentication","i-lucide-lock",{"title":36,"path":37,"stem":38,"icon":39},"Adding modules","\u002Fget-started\u002Fadding-modules","1.get-started\u002F6.adding-modules","i-lucide-puzzle",{"title":41,"path":42,"stem":43,"icon":44},"Database","\u002Fget-started\u002Fdatabase","1.get-started\u002F7.database","i-lucide-database",{"title":46,"path":47,"stem":48,"icon":6},"Deployment","\u002Fget-started\u002Fdeployment","1.get-started\u002F8.deployment",false,{"title":51,"icon":52,"path":53,"stem":54,"children":55,"page":49},"Guide","i-lucide-book-open","\u002Fguide","2.guide",[56,90,115,125],{"title":57,"icon":49,"path":58,"stem":59,"children":60,"page":49},"Concepts","\u002Fguide\u002Fconcepts","2.guide\u002F1.concepts",[61,66,71,76,80,85],{"title":62,"path":63,"stem":64,"icon":65},"Architecture","\u002Fguide\u002Fconcepts\u002Farchitecture","2.guide\u002F1.concepts\u002F1.architecture","i-lucide-blocks",{"title":67,"path":68,"stem":69,"icon":70},"Access control","\u002Fguide\u002Fconcepts\u002Fauth-and-scopes","2.guide\u002F1.concepts\u002F2.auth-and-scopes","i-lucide-shield-check",{"title":72,"path":73,"stem":74,"icon":75},"Extension points","\u002Fguide\u002Fconcepts\u002Fextension-points","2.guide\u002F1.concepts\u002F3.extension-points","i-lucide-plug",{"title":77,"path":78,"stem":79,"icon":44},"Database extensions","\u002Fguide\u002Fconcepts\u002Fdatabase-extensions","2.guide\u002F1.concepts\u002F4.database-extensions",{"title":81,"path":82,"stem":83,"icon":84},"Identity","\u002Fguide\u002Fconcepts\u002Fidentity","2.guide\u002F1.concepts\u002F5.identity","i-lucide-fingerprint",{"title":86,"path":87,"stem":88,"icon":89},"Glossary","\u002Fguide\u002Fconcepts\u002Fglossary","2.guide\u002F1.concepts\u002F6.glossary","i-lucide-book-a",{"title":91,"icon":49,"path":92,"stem":93,"children":94,"page":49},"UX patterns","\u002Fguide\u002Fux-patterns","2.guide\u002F2.ux-patterns",[95,100,105,110],{"title":96,"path":97,"stem":98,"icon":99},"Layouts and navigation","\u002Fguide\u002Fux-patterns\u002Flayouts-and-navigation","2.guide\u002F2.ux-patterns\u002F1.layouts-and-navigation","i-lucide-layout-template",{"title":101,"path":102,"stem":103,"icon":104},"Pages","\u002Fguide\u002Fux-patterns\u002Fpages","2.guide\u002F2.ux-patterns\u002F2.pages","i-lucide-table",{"title":106,"path":107,"stem":108,"icon":109},"Forms and actions","\u002Fguide\u002Fux-patterns\u002Fforms-and-actions","2.guide\u002F2.ux-patterns\u002F3.forms-and-actions","i-lucide-square-pen",{"title":111,"path":112,"stem":113,"icon":114},"Text and formatting","\u002Fguide\u002Fux-patterns\u002Ftext-and-formatting","2.guide\u002F2.ux-patterns\u002F4.text-and-formatting","i-lucide-type",{"title":116,"icon":49,"path":117,"stem":118,"children":119,"page":49},"Best practices","\u002Fguide\u002Fbest-practices","2.guide\u002F3.best-practices",[120],{"title":121,"path":122,"stem":123,"icon":124},"HTTP routes","\u002Fguide\u002Fbest-practices\u002Fhttp-routes","2.guide\u002F3.best-practices\u002F1.http-routes","i-lucide-route",{"title":126,"icon":49,"path":127,"stem":128,"children":129,"page":49},"Going further","\u002Fguide\u002Fgoing-further","2.guide\u002F4.going-further",[130,135,140,145,150],{"title":131,"path":132,"stem":133,"icon":134},"Use your own OAuth server","\u002Fguide\u002Fgoing-further\u002Fown-oauth-server","2.guide\u002F4.going-further\u002F1.own-oauth-server","i-lucide-key-round",{"title":136,"path":137,"stem":138,"icon":139},"Create an OAuth application","\u002Fguide\u002Fgoing-further\u002Foauth-application","2.guide\u002F4.going-further\u002F2.oauth-application","i-lucide-app-window",{"title":141,"path":142,"stem":143,"icon":144},"Signing keys","\u002Fguide\u002Fgoing-further\u002Fsigning-keys","2.guide\u002F4.going-further\u002F3.signing-keys","i-lucide-key-square",{"title":146,"path":147,"stem":148,"icon":149},"Stripe setup","\u002Fguide\u002Fgoing-further\u002Fstripe-setup","2.guide\u002F4.going-further\u002F4.stripe-setup","i-lucide-credit-card",{"title":151,"path":152,"stem":153,"icon":154},"Migrate to the permission model","\u002Fguide\u002Fgoing-further\u002Fmigrate-access-control","2.guide\u002F4.going-further\u002F5.migrate-access-control","i-lucide-arrow-right-left",{"title":156,"icon":157,"path":158,"stem":159,"children":160},"Modules","i-lucide-boxes","\u002Fmodules","3.modules",[161,163,244,273,320,375],{"title":156,"path":158,"stem":162},"3.modules\u002Findex",{"title":81,"icon":49,"path":164,"stem":165,"children":166,"page":49},"\u002Fmodules\u002Fidentity","3.modules\u002F1.identity",[167,190,194,198,220,224,240],{"title":168,"path":169,"stem":170,"children":171},"Auth","\u002Fmodules\u002Fidentity\u002Fauth","3.modules\u002F1.identity\u002F1.auth\u002Findex",[172,174,178,182,186],{"title":173,"path":169,"stem":170},"Overview",{"title":175,"path":176,"stem":177},"Server API","\u002Fmodules\u002Fidentity\u002Fauth\u002Fserver","3.modules\u002F1.identity\u002F1.auth\u002F2.server",{"title":179,"path":180,"stem":181},"Reference","\u002Fmodules\u002Fidentity\u002Fauth\u002Freference","3.modules\u002F1.identity\u002F1.auth\u002F3.reference",{"title":183,"path":184,"stem":185},"Client mode","\u002Fmodules\u002Fidentity\u002Fauth\u002Fclient-mode","3.modules\u002F1.identity\u002F1.auth\u002F4.client-mode",{"title":187,"path":188,"stem":189},"OAuth providers","\u002Fmodules\u002Fidentity\u002Fauth\u002Foauth-providers","3.modules\u002F1.identity\u002F1.auth\u002F5.oauth-providers",{"title":191,"path":192,"stem":193},"Users","\u002Fmodules\u002Fidentity\u002Fusers","3.modules\u002F1.identity\u002F2.users",{"title":195,"path":196,"stem":197},"Account","\u002Fmodules\u002Fidentity\u002Faccount","3.modules\u002F1.identity\u002F3.account",{"title":199,"path":200,"stem":201,"children":202},"Authorization","\u002Fmodules\u002Fidentity\u002Fauthorization","3.modules\u002F1.identity\u002F4.authorization\u002Findex",[203,204,208,212,216],{"title":173,"path":200,"stem":201},{"title":205,"path":206,"stem":207},"Roles and requirements","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Froles-and-requirements","3.modules\u002F1.identity\u002F4.authorization\u002F2.roles-and-requirements",{"title":209,"path":210,"stem":211},"Policies","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fpolicies","3.modules\u002F1.identity\u002F4.authorization\u002F3.policies",{"title":213,"path":214,"stem":215},"Client","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fclient","3.modules\u002F1.identity\u002F4.authorization\u002F4.client",{"title":217,"path":218,"stem":219},"Admin","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fadmin","3.modules\u002F1.identity\u002F4.authorization\u002F5.admin",{"title":221,"path":222,"stem":223},"Preferences","\u002Fmodules\u002Fidentity\u002Fpreferences","3.modules\u002F1.identity\u002F5.preferences",{"title":225,"path":226,"stem":227,"children":228},"OAuth Server","\u002Fmodules\u002Fidentity\u002Foauth-server","3.modules\u002F1.identity\u002F6.oauth-server\u002Findex",[229,230,233,237],{"title":173,"path":226,"stem":227},{"title":175,"path":231,"stem":232},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fserver","3.modules\u002F1.identity\u002F6.oauth-server\u002F2.server",{"title":234,"path":235,"stem":236},"Hooks","\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fhooks","3.modules\u002F1.identity\u002F6.oauth-server\u002F3.hooks",{"title":179,"path":238,"stem":239},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Froutes-and-clients","3.modules\u002F1.identity\u002F6.oauth-server\u002F4.routes-and-clients",{"title":241,"path":242,"stem":243},"OAuth Resource","\u002Fmodules\u002Fidentity\u002Foauth-resource","3.modules\u002F1.identity\u002F8.oauth-resource",{"title":245,"icon":49,"path":246,"stem":247,"children":248,"page":49},"Commerce","\u002Fmodules\u002Fcommerce","3.modules\u002F2.commerce",[249,253,257],{"title":250,"path":251,"stem":252},"Stripe","\u002Fmodules\u002Fcommerce\u002Fstripe","3.modules\u002F2.commerce\u002F1.stripe",{"title":254,"path":255,"stem":256},"Payments","\u002Fmodules\u002Fcommerce\u002Fpayments","3.modules\u002F2.commerce\u002F2.payments",{"title":258,"path":259,"stem":260,"children":261},"Subscriptions","\u002Fmodules\u002Fcommerce\u002Fsubscriptions","3.modules\u002F2.commerce\u002F3.subscriptions\u002Findex",[262,263,266,270],{"title":173,"path":259,"stem":260},{"title":175,"path":264,"stem":265},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fserver","3.modules\u002F2.commerce\u002F3.subscriptions\u002F2.server",{"title":267,"path":268,"stem":269},"App","\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fapp","3.modules\u002F2.commerce\u002F3.subscriptions\u002F3.app",{"title":179,"path":271,"stem":272},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Freference","3.modules\u002F2.commerce\u002F3.subscriptions\u002F4.reference",{"title":274,"icon":49,"path":275,"stem":276,"children":277,"page":49},"Features","\u002Fmodules\u002Ffeatures","3.modules\u002F3.features",[278,293,312,316],{"title":279,"path":280,"stem":281,"children":282},"Events","\u002Fmodules\u002Ffeatures\u002Fevents","3.modules\u002F3.features\u002F1.events\u002Findex",[283,284,287,290],{"title":173,"path":280,"stem":281},{"title":175,"path":285,"stem":286},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fserver","3.modules\u002F3.features\u002F1.events\u002F2.server",{"title":267,"path":288,"stem":289},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fapp","3.modules\u002F3.features\u002F1.events\u002F3.app",{"title":179,"path":291,"stem":292},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Freference","3.modules\u002F3.features\u002F1.events\u002F4.reference",{"title":294,"path":295,"stem":296,"children":297},"Forms","\u002Fmodules\u002Ffeatures\u002Fforms","3.modules\u002F3.features\u002F2.forms\u002Findex",[298,299,303,306,309],{"title":173,"path":295,"stem":296},{"title":300,"path":301,"stem":302},"Definition","\u002Fmodules\u002Ffeatures\u002Fforms\u002Fdefinition","3.modules\u002F3.features\u002F2.forms\u002F2.definition",{"title":175,"path":304,"stem":305},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fserver","3.modules\u002F3.features\u002F2.forms\u002F3.server",{"title":267,"path":307,"stem":308},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fapp","3.modules\u002F3.features\u002F2.forms\u002F4.app",{"title":179,"path":310,"stem":311},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Freference","3.modules\u002F3.features\u002F2.forms\u002F5.reference",{"title":313,"path":314,"stem":315},"Cookie Consent","\u002Fmodules\u002Ffeatures\u002Fcookie-consent","3.modules\u002F3.features\u002F3.cookie-consent",{"title":317,"path":318,"stem":319},"MCP","\u002Fmodules\u002Ffeatures\u002Fmcp","3.modules\u002F3.features\u002F4.mcp",{"title":321,"icon":49,"path":322,"stem":323,"children":324,"page":49},"Interface","\u002Fmodules\u002Finterface","3.modules\u002F4.interface",[325,350,353,357,361],{"title":326,"path":327,"stem":328,"children":329},"UI","\u002Fmodules\u002Finterface\u002Fui","3.modules\u002F4.interface\u002F1.ui\u002Findex",[330,331,335,339,343,347],{"title":173,"path":327,"stem":328},{"title":332,"path":333,"stem":334},"Page components","\u002Fmodules\u002Finterface\u002Fui\u002Fpage-components","3.modules\u002F4.interface\u002F1.ui\u002F2.page-components",{"title":336,"path":337,"stem":338},"App shell","\u002Fmodules\u002Finterface\u002Fui\u002Fapp-shell","3.modules\u002F4.interface\u002F1.ui\u002F3.app-shell",{"title":340,"path":341,"stem":342},"Form inputs","\u002Fmodules\u002Finterface\u002Fui\u002Fform-inputs","3.modules\u002F4.interface\u002F1.ui\u002F4.form-inputs",{"title":344,"path":345,"stem":346},"Composables and helpers","\u002Fmodules\u002Finterface\u002Fui\u002Fcomposables","3.modules\u002F4.interface\u002F1.ui\u002F5.composables",{"title":179,"path":348,"stem":349},"\u002Fmodules\u002Finterface\u002Fui\u002Freference","3.modules\u002F4.interface\u002F1.ui\u002F6.reference",{"title":217,"path":351,"stem":352},"\u002Fmodules\u002Finterface\u002Fadmin","3.modules\u002F4.interface\u002F2.admin",{"title":354,"path":355,"stem":356},"Menu","\u002Fmodules\u002Finterface\u002Fmenu","3.modules\u002F4.interface\u002F3.menu",{"title":358,"path":359,"stem":360},"Widget","\u002Fmodules\u002Finterface\u002Fwidget","3.modules\u002F4.interface\u002F4.widget",{"title":362,"path":363,"stem":364,"children":365},"Mobile","\u002Fmodules\u002Finterface\u002Fmobile","3.modules\u002F4.interface\u002F5.mobile\u002Findex",[366,367,371],{"title":173,"path":363,"stem":364},{"title":368,"path":369,"stem":370},"CLI and devices","\u002Fmodules\u002Finterface\u002Fmobile\u002Fcli-and-devices","3.modules\u002F4.interface\u002F5.mobile\u002F2.cli-and-devices",{"title":372,"path":373,"stem":374},"Splash screen","\u002Fmodules\u002Finterface\u002Fmobile\u002Fsplash-screen","3.modules\u002F4.interface\u002F5.mobile\u002F3.splash-screen",{"title":376,"icon":49,"path":377,"stem":378,"children":379,"page":49},"Platform","\u002Fmodules\u002Fplatform","3.modules\u002F5.platform",[380,402,406,423],{"title":381,"path":382,"stem":383,"children":384},"Module Kit","\u002Fmodules\u002Fplatform\u002Fmodule-kit","3.modules\u002F5.platform\u002F1.module-kit\u002Findex",[385,386,390,394,398],{"title":173,"path":382,"stem":383},{"title":387,"path":388,"stem":389},"Server toolkit","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fserver-toolkit","3.modules\u002F5.platform\u002F1.module-kit\u002F2.server-toolkit",{"title":391,"path":392,"stem":393},"Registries and menus","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fregistries-and-menus","3.modules\u002F5.platform\u002F1.module-kit\u002F3.registries-and-menus",{"title":395,"path":396,"stem":397},"Translations","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fi18n","3.modules\u002F5.platform\u002F1.module-kit\u002F4.i18n",{"title":399,"path":400,"stem":401},"Database helpers","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fdatabase","3.modules\u002F5.platform\u002F1.module-kit\u002F5.database",{"title":403,"path":404,"stem":405},"Notify","\u002Fmodules\u002Fplatform\u002Fnotify","3.modules\u002F5.platform\u002F2.notify",{"title":407,"path":408,"stem":409,"children":410},"Email Templates","\u002Fmodules\u002Fplatform\u002Femail-templates","3.modules\u002F5.platform\u002F3.email-templates\u002Findex",[411,412,416,419],{"title":173,"path":408,"stem":409},{"title":413,"path":414,"stem":415},"Email components","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fcomponents","3.modules\u002F5.platform\u002F3.email-templates\u002F2.components",{"title":175,"path":417,"stem":418},"\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fserver","3.modules\u002F5.platform\u002F3.email-templates\u002F3.server",{"title":420,"path":421,"stem":422},"Module emails","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fmodule-emails","3.modules\u002F5.platform\u002F3.email-templates\u002F4.module-emails",{"title":424,"path":425,"stem":426,"children":427},"Base Layer","\u002Fmodules\u002Fplatform\u002Fbase-layer","3.modules\u002F5.platform\u002F4.base-layer\u002Findex",[428,429,433,437],{"title":173,"path":425,"stem":426},{"title":430,"path":431,"stem":432},"Content collections","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcontent-collections","3.modules\u002F5.platform\u002F4.base-layer\u002F2.content-collections",{"title":434,"path":435,"stem":436},"Layouts and routing","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Flayouts-and-routing","3.modules\u002F5.platform\u002F4.base-layer\u002F3.layouts-and-routing",{"title":438,"path":439,"stem":440},"Composables and utils","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcomposables-and-utils","3.modules\u002F5.platform\u002F4.base-layer\u002F4.composables-and-utils",{"title":442,"icon":443,"path":444,"stem":445,"children":446,"page":49},"Examples","i-lucide-code-xml","\u002Fexamples","4.examples",[447,466,476],{"title":448,"icon":49,"path":449,"stem":450,"children":451,"page":49},"Starters","\u002Fexamples\u002Fstarters","4.examples\u002F1.starters",[452,456,461],{"title":453,"path":454,"stem":455,"icon":6},"Workspace starter","\u002Fexamples\u002Fstarters\u002Fworkspace","4.examples\u002F1.starters\u002F1.workspace",{"title":457,"path":458,"stem":459,"icon":460},"Mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile","4.examples\u002F1.starters\u002F2.mobile","i-lucide-smartphone",{"title":462,"path":463,"stem":464,"icon":465},"Standalone mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile-standalone","4.examples\u002F1.starters\u002F3.mobile-standalone","i-lucide-tablet-smartphone",{"title":467,"icon":49,"path":468,"stem":469,"children":470,"page":49},"Apps","\u002Fexamples\u002Fapps","4.examples\u002F2.apps",[471],{"title":472,"path":473,"stem":474,"icon":475},"Frigear website app","\u002Fexamples\u002Fapps\u002Ffrigear-nu-website","4.examples\u002F2.apps\u002F1.frigear-nu-website","i-lucide-layout-dashboard",{"title":477,"icon":49,"path":478,"stem":479,"children":480,"page":49},"Tasks","\u002Fexamples\u002Ftasks","4.examples\u002F3.tasks",[481,485,489,494,499],{"title":482,"path":483,"stem":484,"icon":70},"Protect a route","\u002Fexamples\u002Ftasks\u002Fprotect-a-route","4.examples\u002F3.tasks\u002F1.protect-a-route",{"title":486,"path":487,"stem":488,"icon":475},"Add an admin page","\u002Fexamples\u002Ftasks\u002Fadd-an-admin-page","4.examples\u002F3.tasks\u002F2.add-an-admin-page",{"title":490,"path":491,"stem":492,"icon":493},"Sell event tickets","\u002Fexamples\u002Ftasks\u002Fsell-event-tickets","4.examples\u002F3.tasks\u002F3.sell-event-tickets","i-lucide-ticket",{"title":495,"path":496,"stem":497,"icon":498},"Build a form","\u002Fexamples\u002Ftasks\u002Fbuild-a-form","4.examples\u002F3.tasks\u002F4.build-a-form","i-lucide-clipboard-list",{"title":500,"path":501,"stem":502,"icon":503},"Send an email","\u002Fexamples\u002Ftasks\u002Fsend-an-email","4.examples\u002F3.tasks\u002F5.send-an-email","i-lucide-mail",{"title":505,"icon":506,"path":507,"stem":508,"children":509,"page":49},"Contribute","i-lucide-git-pull-request","\u002Fcontribute","5.contribute",[510,513,518,544,549,552,556,571],{"title":173,"path":511,"stem":512,"icon":506},"\u002Fcontribute\u002Foverview","5.contribute\u002F1.overview",{"title":514,"path":515,"stem":516,"icon":517},"Local development","\u002Fcontribute\u002Flocal-development","5.contribute\u002F2.local-development","i-lucide-terminal",{"title":519,"icon":49,"path":520,"stem":521,"children":522,"page":49},"Writing a module","\u002Fcontribute\u002Fwriting-a-module","5.contribute\u002F3.writing-a-module",[523,527,532,536,541],{"title":524,"path":525,"stem":526,"icon":39},"Scaffold a module","\u002Fcontribute\u002Fwriting-a-module\u002Fscaffold","5.contribute\u002F3.writing-a-module\u002F1.scaffold",{"title":528,"path":529,"stem":530,"icon":531},"Setup checklist","\u002Fcontribute\u002Fwriting-a-module\u002Fsetup-checklist","5.contribute\u002F3.writing-a-module\u002F2.setup-checklist","i-lucide-list-checks",{"title":533,"path":534,"stem":535,"icon":44},"Database tables","\u002Fcontribute\u002Fwriting-a-module\u002Fdatabase-tables","5.contribute\u002F3.writing-a-module\u002F3.database-tables",{"title":537,"path":538,"stem":539,"icon":540},"Testing","\u002Fcontribute\u002Fwriting-a-module\u002Ftesting","5.contribute\u002F3.writing-a-module\u002F4.testing","i-lucide-flask-conical",{"title":67,"path":542,"stem":543,"icon":70},"\u002Fcontribute\u002Fwriting-a-module\u002Faccess-control","5.contribute\u002F3.writing-a-module\u002F5.access-control",{"title":545,"path":546,"stem":547,"icon":548},"Publishing","\u002Fcontribute\u002Fpublishing","5.contribute\u002F4.publishing","i-lucide-package-check",{"title":448,"path":550,"stem":551,"icon":6},"\u002Fcontribute\u002Fstarters","5.contribute\u002F5.starters",{"title":553,"path":554,"stem":555,"icon":52},"Documentation","\u002Fcontribute\u002Fdocumentation","5.contribute\u002F6.documentation",{"title":557,"icon":49,"path":558,"stem":559,"children":560,"page":49},"Tooling","\u002Fcontribute\u002Ftooling","5.contribute\u002F7.tooling",[561,566],{"title":562,"path":563,"stem":564,"icon":565},"CLI","\u002Fcontribute\u002Ftooling\u002Fcli","5.contribute\u002F7.tooling\u002F1.cli","i-lucide-square-terminal",{"title":567,"path":568,"stem":569,"icon":570},"ESLint config","\u002Fcontribute\u002Ftooling\u002Feslint-config","5.contribute\u002F7.tooling\u002F2.eslint-config","i-lucide-spell-check",{"title":572,"icon":49,"path":573,"stem":574,"children":575},"Decisions","\u002Fcontribute\u002Fdecisions","5.contribute\u002F8.decisions\u002Findex",[576,578,583],{"title":572,"path":573,"stem":574,"icon":577},"i-lucide-scale",{"title":579,"path":580,"stem":581,"icon":582},"Session lifetimes per OAuth client","\u002Fcontribute\u002Fdecisions\u002Foauth-token-lifetimes","5.contribute\u002F8.decisions\u002F1.oauth-token-lifetimes","i-lucide-timer",{"title":584,"path":585,"stem":586,"icon":70},"One permission model","\u002Fcontribute\u002Fdecisions\u002Fpermission-model","5.contribute\u002F8.decisions\u002F2.permission-model",{"id":588,"title":151,"body":589,"description":2576,"extension":2577,"links":2578,"meta":2579,"navigation":2580,"path":152,"seo":2581,"stem":153,"__hash__":2582},"docs\u002F2.guide\u002F4.going-further\u002F5.migrate-access-control.md",{"type":590,"value":591,"toc":2553},"minimark",[592,618,638,643,693,697,702,1029,1032,1307,1310,1375,1379,1382,1579,1583,1589,1642,1645,1705,1711,1736,1746,1752,1770,2069,2081,2085,2527,2531,2549],[593,594,595,596,600,601,605,606,609,610,613,614,617],"p",{},"This release replaces three overlapping access systems with one: ",[597,598,599],"strong",{},"permissions"," (",[602,603,604],"code",{},"resource:action","), ",[597,607,608],{},"roles"," that\nbundle them, ",[597,611,612],{},"scopes"," for delegated credentials, and ",[597,615,616],{},"policies"," that refine a check against a record. There are no\ncompatibility shims. A removed option or hook either fails the build or, for a hook listener, logs a warning in\ndevelopment and never runs.",[619,620,622,625,626,629,630,633,634,637],"callout",{"icon":621},"i-lucide-users",[597,623,624],{},"For:"," anyone who upgrades a host app or a module that checked roles, abilities, scopes or a ",[602,627,628],{},"\u003Cmodule>:authorize","\nhook. The model itself is in ",[631,632,67],"a",{"href":68},"; the reasons are in the\n",[631,635,636],{"href":585},"decision record",".",[639,640,642],"h2",{"id":641},"what-changed-and-why","What changed and why",[644,645,646,672],"ul",{},[647,648,649,652,653,656,657,660,661,664,665,668,669,671],"li",{},[597,650,651],{},"Before."," ",[602,654,655],{},"defineAbility"," functions saw only the user. Route rules, ",[602,658,659],{},"admin.settings.roles"," and documents compared\n",[602,662,663],{},"user.role"," with a fixed name. Behind ",[602,666,667],{},"rbac: true",", \"scopes\" and \"permissions\" were the same string. Every module added\nits own ",[602,670,628],{}," hook, with three different defaults when RBAC was off (one was \"allow everything\").",[647,673,674,677,678,681,682,685,686,689,690,637],{},[597,675,676],{},"Now."," Code checks one thing: a registered permission, with ",[602,679,680],{},"authorize(event, permission, record?)",". A user holds\nseveral roles, which come from ",[602,683,684],{},"authorization.roles"," only. A token holds the permissions frozen into it when it was\nissued. One hook, ",[602,687,688],{},"authorization:before",", is the host override. Everything ",[597,691,692],{},"fails closed",[639,694,696],{"id":695},"old-to-new","Old to new",[698,699,701],"h3",{"id":700},"server-api-and-hooks","Server API and hooks",[703,704,705,718],"table",{},[706,707,708],"thead",{},[709,710,711,715],"tr",{},[712,713,714],"th",{},"Removed",[712,716,717],{},"Replacement",[719,720,721,750,767,786,808,827,844,856,873,886,910,925,938,954,966,981,993,1008],"tbody",{},[709,722,723,733],{},[724,725,726,729,730],"td",{},[602,727,728],{},"requireAuth(event, { scopes })",", ",[602,731,732],{},"requireUser(event, { scopes })",[724,734,735,738,739,742,743,746,747,637],{},[602,736,737],{},"await authorize(event, 'resource:action')",". ",[602,740,741],{},"requireAuth"," \u002F ",[602,744,745],{},"requireUser"," now only authenticate, and take ",[602,748,749],{},"sessionOnly",[709,751,752,757],{},[724,753,754],{},[602,755,756],{},"principalHasScopes(principal, scopes)",[724,758,759,762,763,766],{},[602,760,761],{},"await allows(event, permission)",", or ",[602,764,765],{},"inspect"," for the reason.",[709,768,769,779],{},[724,770,771,729,773,729,776],{},[602,772,655],{},[602,774,775],{},"abilities",[602,777,778],{},"bouncer",[724,780,781,782,785],{},"A permission plus a role grant, and a policy (",[602,783,784],{},"definePolicy",") for record rules.",[709,787,788,799],{},[724,789,790,729,793,729,796],{},[602,791,792],{},"defineStaffGuard({ hook, scope, message })",[602,794,795],{},"guard.require",[602,797,798],{},"guard.can",[724,800,801,804,805,637],{},[602,802,803],{},"authorize(event, '\u003Cmodule>:manage')",", and ",[602,806,807],{},"allows(event, ...)",[709,809,810,818],{},[724,811,812,729,815],{},[602,813,814],{},"definePolicyGate",[602,816,817],{},"defineStaffScopes",[724,819,820,821,804,824,826],{},"A registered permission with ",[602,822,823],{},"grantTo",[602,825,688],{}," or a policy for host rules.",[709,828,829,834],{},[724,830,831],{},[602,832,833],{},"addAuthScope(nuxt, { name, roles })",[724,835,836,839,840,843],{},[602,837,838],{},"addPermission(nuxt, { name, label, grantTo })"," for what code checks, ",[602,841,842],{},"addScope(nuxt, { name, permissions })"," for a named group of permissions.",[709,845,846,851],{},[724,847,848],{},[602,849,850],{},"addAuthRole(nuxt, ...)",[724,852,853,637],{},[602,854,855],{},"addRole(nuxt, { name, grant, inherit })",[709,857,858,863],{},[724,859,860],{},[602,861,862],{},"addOAuthScope",[724,864,865,868,869,872],{},[602,866,867],{},"addScope",", from ",[602,870,871],{},"@frigear-nu\u002Fauth\u002Futils",". It serves API tokens and OAuth alike.",[709,874,875,881],{},[724,876,877,880],{},[602,878,879],{},"ctx.hasScope(scope)"," (MCP)",[724,882,883,637],{},[602,884,885],{},"await ctx.can(permission)",[709,887,888,905],{},[724,889,890,729,893,729,896,729,899,729,902],{},[602,891,892],{},"events:authorize",[602,894,895],{},"forms:authorize",[602,897,898],{},"payments:authorize",[602,900,901],{},"oauth:authorize",[602,903,904],{},"authorization:authorize",[724,906,907,909],{},[602,908,688],{},", or a policy on the module's permissions.",[709,911,912,917],{},[724,913,914],{},[602,915,916],{},"users:admin:authorize",[724,918,919,921,922,637],{},[602,920,688],{},", or a policy on ",[602,923,924],{},"users:*",[709,926,927,932],{},[724,928,929],{},[602,930,931],{},"users:admin:roles",[724,933,934,935,937],{},"Roles in ",[602,936,684],{},"; the roles tab of the user admin assigns them.",[709,939,940,945],{},[724,941,942],{},[602,943,944],{},"authorization:role",[724,946,947,950,951,637],{},[602,948,949],{},"authorization:roles",": push to or splice from ",[602,952,953],{},"ctx.roles",[709,955,956,961],{},[724,957,958],{},[602,959,960],{},"auth:user-permissions",[724,962,963,964,637],{},"Roles, or ",[602,965,688],{},[709,967,968,973],{},[724,969,970],{},[602,971,972],{},"auth:scope-available",[724,974,975,978,979,637],{},[602,976,977],{},"canGrantScope"," decides what a token or client may be given; refine it with ",[602,980,688],{},[709,982,983,988],{},[724,984,985],{},[602,986,987],{},"oauth:scope:staff",[724,989,990,991,637],{},"Roles that grant the permission, or ",[602,992,688],{},[709,994,995,1000],{},[724,996,997],{},[602,998,999],{},"oauth:user:roles",[724,1001,1002,738,1004,1007],{},[602,1003,949],{},[602,1005,1006],{},"allowedRoles"," resolves through the role provider.",[709,1009,1010,1020],{},[724,1011,1012,1013,1016,1017,1019],{},"The old ",[602,1014,1015],{},"me\u002Fpermissions"," route of authorization and the users admin ",[602,1018,608],{}," route",[724,1021,1022,1025,1026,637],{},[602,1023,1024],{},"GET \u002Fapi\u002Fauth\u002Fme\u002Faccess"," returns ",[602,1027,1028],{},"{ kind, scopes, permissions, roles? }",[698,1030,26],{"id":1031},"configuration",[703,1033,1034,1042],{},[706,1035,1036],{},[709,1037,1038,1040],{},[712,1039,714],{},[712,1041,717],{},[719,1043,1044,1054,1067,1080,1091,1105,1118,1142,1155,1167,1189,1208,1228,1240,1264,1278,1288],{},[709,1045,1046,1051],{},[724,1047,1048],{},[602,1049,1050],{},"authorization.rbac",[724,1052,1053],{},"Nothing: there is one model. Delete the flag.",[709,1055,1056,1064],{},[724,1057,1058,729,1061],{},[602,1059,1060],{},"authorization.abilities",[602,1062,1063],{},"resolvers",[724,1065,1066],{},"Permissions, roles and policies.",[709,1068,1069,1074],{},[724,1070,1071],{},[602,1072,1073],{},"authorization.roles.hierarchy",[724,1075,1076,1079],{},[602,1077,1078],{},"inherit"," on each role.",[709,1081,1082,1087],{},[724,1083,1084],{},[602,1085,1086],{},"authorization.roles.inherits",[724,1088,1089,1079],{},[602,1090,1078],{},[709,1092,1093,1099],{},[724,1094,1095,1098],{},[602,1096,1097],{},"authorization.roles.grant"," (per-role map)",[724,1100,1101,1104],{},[602,1102,1103],{},"grant"," inside each role definition.",[709,1106,1107,1112],{},[724,1108,1109],{},[602,1110,1111],{},"authorization.roles.revoke",[724,1113,1114,1115,1117],{},"Nothing. Roles only add. Remove the permission from the role's ",[602,1116,1103],{},", or do not inherit a role that has it.",[709,1119,1120,1128],{},[724,1121,1122,729,1125],{},[602,1123,1124],{},"authorization.roles.labels",[602,1126,1127],{},"descriptions",[724,1129,1130,729,1133,729,1136,729,1139,1079],{},[602,1131,1132],{},"label",[602,1134,1135],{},"labelKey",[602,1137,1138],{},"description",[602,1140,1141],{},"descriptionKey",[709,1143,1144,1149],{},[724,1145,1146],{},[602,1147,1148],{},"authorization.roles.definitions",[724,1150,1151,1152,637],{},"The role entries themselves: ",[602,1153,1154],{},"authorization.roles.\u003Cname>",[709,1156,1157,1162],{},[724,1158,1159],{},[602,1160,1161],{},"authorization.roles.defaultRole",[724,1163,1164,637],{},[602,1165,1166],{},"authorization.defaultRoles: ['user']",[709,1168,1169,1179],{},[724,1170,1171,1172,729,1174,729,1177],{},"Route rule keys ",[602,1173,608],{},[602,1175,1176],{},"ability",[602,1178,612],{},[724,1180,1181,1184,1185,1188],{},[602,1182,1183],{},"permission",". These keys ",[597,1186,1187],{},"fail the build",": a rule that still used one would leave its routes open.",[709,1190,1191,1203],{},[724,1192,1193,729,1196,1199,1200],{},[602,1194,1195],{},"meta.roles",[602,1197,1198],{},"meta.ability"," in ",[602,1201,1202],{},"definePageMeta({ authorize })",[724,1204,1205,637],{},[602,1206,1207],{},"definePageMeta({ authorize: 'resource:action' })",[709,1209,1210,1214],{},[724,1211,1212],{},[602,1213,659],{},[724,1215,1216,1219,1220,1223,1224,1227],{},[602,1217,1218],{},"admin.settings.permission"," (default ",[602,1221,1222],{},"admin:access",", granted to ",[602,1225,1226],{},"admin","). Using the old key throws at build time.",[709,1229,1230,1235],{},[724,1231,1232],{},[602,1233,1234],{},"account.settings.documents[].roles",[724,1236,1237,1239],{},[602,1238,1183],{},". Using the old key throws at build time.",[709,1241,1242,1255],{},[724,1243,1244,1247,1248,729,1250,729,1253],{},[602,1245,1246],{},"mcp"," definitions with ",[602,1249,612],{},[602,1251,1252],{},"gate",[602,1254,749],{},[724,1256,1257,1260,1261,1263],{},[602,1258,1259],{},"{ permission: 'resource:action' }",". A definition without one is never exposed. Use a ",[602,1262,749],{}," permission for money and credentials.",[709,1265,1266,1272],{},[724,1267,1268,1271],{},[602,1269,1270],{},"staffOnly"," on OAuth scopes and applications",[724,1273,1274,1275,637],{},"Roles and ",[602,1276,1277],{},"roleScopes",[709,1279,1280,1285],{},[724,1281,1282],{},[602,1283,1284],{},"oauthServer.clients[].allowedRoles",[724,1286,1287],{},"Still there, now resolved through the role provider (effective roles, inheritance included).",[709,1289,1290,1297],{},[724,1291,1292,1293,1296],{},"The ",[602,1294,1295],{},"users.role"," field",[724,1298,1299,1300,1303,1304,1306],{},"Roles live in ",[602,1301,1302],{},"authorization_user_roles",". The column stays one release for the copy, is not read by access control, and is dropped next release. The ",[602,1305,663],{}," type is deprecated.",[698,1308,213],{"id":1309},"client",[703,1311,1312,1320],{},[706,1313,1314],{},[709,1315,1316,1318],{},[712,1317,714],{},[712,1319,717],{},[719,1321,1322,1339,1357],{},[709,1323,1324,1330],{},[724,1325,1326,1329],{},[602,1327,1328],{},"useAuthorization().can(ability, ...)"," against abilities",[724,1331,1332,1335,1336,1338],{},[602,1333,1334],{},"can(permission, record?)",": synchronous, from ",[602,1337,1024],{},", then shared policies.",[709,1340,1341,1349],{},[724,1342,1343,729,1346],{},[602,1344,1345],{},"\u003CCan ability=\"...\">",[602,1347,1348],{},"\u003CCan role=\"...\">",[724,1350,1351,804,1354,637],{},[602,1352,1353],{},"\u003CCan permission=\"events:update\" :record=\"event\">",[602,1355,1356],{},"\u003CCannot>",[709,1358,1359,1370],{},[724,1360,1361,729,1364,1367,1368],{},[602,1362,1363],{},"menu",[602,1365,1366],{},"widget"," and account items with ",[602,1369,608],{},[724,1371,1372,637],{},[602,1373,1374],{},"permission: 'resource:action'",[639,1376,1378],{"id":1377},"behaviour-changes-that-bite","Behaviour changes that bite",[593,1380,1381],{},"These follow from \"fail closed\". Check each against your app before you deploy.",[644,1383,1384,1416,1427,1460,1469,1487,1509,1523,1534,1543,1549,1558,1570],{},[647,1385,1386,1389,1390,1393,1394,729,1397,1400,1401,1403,1404,1407,1408,1411,1412,1415],{},[597,1387,1388],{},"No authorization installed."," Only ",[602,1391,1392],{},"implicit"," permissions (self-service such as ",[602,1395,1396],{},"tickets:read",[602,1398,1399],{},"profile:write",") and\n",[602,1402,688],{}," apply. Route rules are still enforced. A staff route with no role provider and no ",[602,1405,1406],{},"before","\nlistener answers ",[602,1409,1410],{},"403",", where it may have answered ",[602,1413,1414],{},"200"," before.",[647,1417,1418,1423,1424,1426],{},[597,1419,1420,1421,637],{},"An unregistered permission is a ",[602,1422,1410],{}," A route that checks a name nobody registered fails, also for admins and\nalso when ",[602,1425,1406],{}," allows. In development it logs an error too. A route rule or page meta naming an unknown\npermission fails the build.",[647,1428,1429,652,1435,1437,1438,1441,1442,1445,1446,1449,1450,1453,1454,1456,1457,1459],{},[597,1430,1431,1434],{},[602,1432,1433],{},"*"," never covers a sensitive permission.",[602,1436,1433],{}," and ",[602,1439,1440],{},"resource:*"," skip ",[602,1443,1444],{},":pii"," permissions (",[602,1447,1448],{},"events:pii",",\n",[602,1451,1452],{},"forms:pii","). Grant them by name. ",[602,1455,823],{}," on the permission puts them into ",[602,1458,1226],{}," for you.",[647,1461,1462,1468],{},[597,1463,1464,1465,1467],{},"Plain users cannot mint ",[602,1466,1433],{}," tokens."," A user holds only what their roles grant, and a token cannot hold more than\nits user. A wildcard token needs a user whose roles cover it.",[647,1470,1471,652,1477,1480,1481,1483,1484,1486],{},[597,1472,1473,1476],{},[602,1474,1475],{},"users:list"," is now needed to list users.",[602,1478,1479],{},"users:read"," opens one user; the directory and the sign-up numbers need\n",[602,1482,1475],{},". The old ",[602,1485,1479],{}," roles need both.",[647,1488,1489,1497,1498,1501,1502,1504,1505,1508],{},[597,1490,1491,1494,1495,637],{},[602,1492,1493],{},"events:refund"," is new and ",[602,1496,749],{}," Refunds are money. Roles that name ",[602,1499,1500],{},"events:manage"," need ",[602,1503,1493],{},"\ntoo; ",[602,1506,1507],{},"events:*"," covers it. An API token or OAuth token never refunds.",[647,1510,1511,1518,1519,1522],{},[597,1512,1513,1494,1516,637],{},[602,1514,1515],{},"forms:credentials",[602,1517,749],{}," Creating or removing form access tokens, passwords and secrets.\nRoles that name ",[602,1520,1521],{},"forms:manage"," need it too.",[647,1524,1525,1533],{},[597,1526,1527,1530,1531,637],{},[602,1528,1529],{},"subscriptions:manage"," is ",[602,1532,749],{}," Granting free memberships and sending payment links is cookie sessions\nonly.",[647,1535,1536,1542],{},[597,1537,1538,1539],{},"A user's payment history in the admin needs ",[602,1540,1541],{},"payments:manage",", not just a staff role.",[647,1544,1545,1548],{},[597,1546,1547],{},"Token permissions are frozen."," A token or OAuth access token carries the permissions it had when it was issued,\nintersected with its user's. Demoting a user does not shrink an old token's claim, but every check still goes through\nthe user's current permissions, so a demoted user's token loses access at once. A token minted before the upgrade has\nno frozen set and holds nothing: mint it again.",[647,1550,1551,1557],{},[597,1552,1553,1554,1556],{},"DB scopes cannot hold wildcards, sensitive or ",[602,1555,749],{}," permissions."," The admin refuses them. Config scopes\nare the same: a named scope that expands to a sensitive or session-only permission fails the build.",[647,1559,1560,1569],{},[597,1561,1562,1563,1530,1566,637],{},"An unknown scope at ",[602,1564,1565],{},"\u002Foauth\u002Fauthorize",[602,1567,1568],{},"invalid_scope"," It used to be dropped. On refresh, scopes are still\nfiltered silently.",[647,1571,1572,1575,1576,1578],{},[597,1573,1574],{},"A role that is in the data but not in config is ignored"," and listed in a startup warning. Add it to\n",[602,1577,684],{}," or remove it.",[639,1580,1582],{"id":1581},"move-the-roles-in-your-data","Move the roles in your data",[593,1584,1585,1586,1588],{},"Existing users kept one role each in ",[602,1587,1295],{},". A one-time, automatic step copies it:",[1590,1591,1592,1616,1630,1637],"ol",{},[647,1593,1594,1595,1598,1599,1601,1602,1605,1606,1609,1610,1612,1613,637],{},"On the first request after the upgrade, ",[602,1596,1597],{},"@frigear-nu\u002Fauthorization"," copies every ",[602,1600,1295],{}," that is not ",[602,1603,1604],{},"user","\n(and is not a default or ",[602,1607,1608],{},"auto"," role) into ",[602,1611,1302],{}," with ",[602,1614,1615],{},"source = 'migrated'",[647,1617,1618,1619,1622,1623,1626,1627,1629],{},"It then writes a marker (",[602,1620,1621],{},"users-role-migrated",") into ",[602,1624,1625],{},"authorization_meta",", so it never runs again. Removing a role\nlater cannot bring it back, because nothing reads ",[602,1628,1295],{}," as a fallback.",[647,1631,1632,1633,1636],{},"Single sign-on writes its own rows (",[602,1634,1635],{},"source = 'sso'",") and never touches manual ones.",[647,1638,1292,1639,1641],{},[602,1640,1295],{}," column is dropped in the next release.",[593,1643,1644],{},"Verify it. Both queries list users whose old role has no row, so they should return nothing:",[1646,1647,1648,1684],"code-group",{},[1649,1650,1656],"pre",{"className":1651,"code":1652,"filename":1653,"language":1654,"meta":1655,"style":1655},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","SELECT u.id, u.email, u.role\nFROM users u\nLEFT JOIN authorization_user_roles r ON r.user_id = u.id AND r.role = u.role\nWHERE u.role IS NOT NULL AND u.role \u003C> 'user' AND r.user_id IS NULL;\n","sqlite","sql","",[602,1657,1658,1666,1672,1678],{"__ignoreMap":1655},[1659,1660,1663],"span",{"class":1661,"line":1662},"line",1,[1659,1664,1665],{},"SELECT u.id, u.email, u.role\n",[1659,1667,1669],{"class":1661,"line":1668},2,[1659,1670,1671],{},"FROM users u\n",[1659,1673,1675],{"class":1661,"line":1674},3,[1659,1676,1677],{},"LEFT JOIN authorization_user_roles r ON r.user_id = u.id AND r.role = u.role\n",[1659,1679,1681],{"class":1661,"line":1680},4,[1659,1682,1683],{},"WHERE u.role IS NOT NULL AND u.role \u003C> 'user' AND r.user_id IS NULL;\n",[1649,1685,1687],{"className":1651,"code":1652,"filename":1686,"language":1654,"meta":1655,"style":1655},"postgresql",[602,1688,1689,1693,1697,1701],{"__ignoreMap":1655},[1659,1690,1691],{"class":1661,"line":1662},[1659,1692,1665],{},[1659,1694,1695],{"class":1661,"line":1668},[1659,1696,1671],{},[1659,1698,1699],{"class":1661,"line":1674},[1659,1700,1677],{},[1659,1702,1703],{"class":1661,"line":1680},[1659,1704,1683],{},[593,1706,1707,1708,1710],{},"A role that is a default or ",[602,1709,1608],{}," role in your config is legitimately missing from the result of the copy: list it by\nname in the query, or ignore it. To see what was copied and which names are unknown to your config:",[1649,1712,1714],{"className":1651,"code":1713,"language":1654,"meta":1655,"style":1655},"SELECT role, source, COUNT(*) AS users\nFROM authorization_user_roles\nGROUP BY role, source\nORDER BY role;\n",[602,1715,1716,1721,1726,1731],{"__ignoreMap":1655},[1659,1717,1718],{"class":1661,"line":1662},[1659,1719,1720],{},"SELECT role, source, COUNT(*) AS users\n",[1659,1722,1723],{"class":1661,"line":1668},[1659,1724,1725],{},"FROM authorization_user_roles\n",[1659,1727,1728],{"class":1661,"line":1674},[1659,1729,1730],{},"GROUP BY role, source\n",[1659,1732,1733],{"class":1661,"line":1680},[1659,1734,1735],{},"ORDER BY role;\n",[1737,1738,1739,1740,1742,1743,637],"note",{},"Roles that match nothing in ",[602,1741,684],{}," are kept and ignored. The startup log names them:\n",[602,1744,1745],{},"stored roles that are not configured are kept and ignored",[639,1747,1749,1750],{"id":1748},"move-an-allowlist-to-authorizationroles","Move an allowlist to ",[602,1751,949],{},[593,1753,1754,1755,1758,1759,1762,1763,1766,1767,1769],{},"A host that made email allowlists administrators (",[602,1756,1757],{},"NUXT_ACL_ADMINS",", a ",[602,1760,1761],{},"*-policy.ts"," plugin, ",[602,1764,1765],{},"effectiveRole",") now\nadds the role in the ",[602,1768,949],{}," hook. The role is not stored, so removing an address removes the access at\nonce.",[1649,1771,1776],{"className":1772,"code":1773,"filename":1774,"language":1775,"meta":1655,"style":1655},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","export default defineNitroPlugin((nitro) => {\n  const admins = new Set((process.env.NUXT_ACL_ADMINS ?? '').split(',').map(email => email.trim().toLowerCase()).filter(Boolean))\n  nitro.hooks.hook('authorization:roles', (ctx) => {\n    if (admins.has(ctx.user.email.toLowerCase()) && !ctx.roles.includes('admin')) {\n      ctx.roles.push('admin') \u002F\u002F identify the user from ctx.user, never from the session on ctx.event\n    }\n  })\n})\n","server\u002Fplugins\u002Fauthorization-roles.ts","ts",[602,1777,1778,1812,1915,1951,2016,2046,2052,2061],{"__ignoreMap":1655},[1659,1779,1780,1784,1787,1791,1795,1798,1802,1805,1809],{"class":1661,"line":1662},[1659,1781,1783],{"class":1782},"s7zQu","export",[1659,1785,1786],{"class":1782}," default",[1659,1788,1790],{"class":1789},"s2Zo4"," defineNitroPlugin",[1659,1792,1794],{"class":1793},"sTEyZ","(",[1659,1796,1794],{"class":1797},"sMK4o",[1659,1799,1801],{"class":1800},"sHdIc","nitro",[1659,1803,1804],{"class":1797},")",[1659,1806,1808],{"class":1807},"spNyl"," =>",[1659,1810,1811],{"class":1797}," {\n",[1659,1813,1814,1817,1820,1823,1826,1829,1833,1836,1838,1841,1843,1845,1848,1851,1853,1855,1858,1860,1863,1867,1869,1871,1873,1876,1878,1881,1883,1886,1888,1891,1894,1896,1899,1902,1904,1907,1909,1912],{"class":1661,"line":1668},[1659,1815,1816],{"class":1807},"  const",[1659,1818,1819],{"class":1793}," admins",[1659,1821,1822],{"class":1797}," =",[1659,1824,1825],{"class":1797}," new",[1659,1827,1828],{"class":1789}," Set",[1659,1830,1832],{"class":1831},"swJcz","((",[1659,1834,1835],{"class":1793},"process",[1659,1837,637],{"class":1797},[1659,1839,1840],{"class":1793},"env",[1659,1842,637],{"class":1797},[1659,1844,1757],{"class":1793},[1659,1846,1847],{"class":1797}," ??",[1659,1849,1850],{"class":1797}," ''",[1659,1852,1804],{"class":1831},[1659,1854,637],{"class":1797},[1659,1856,1857],{"class":1789},"split",[1659,1859,1794],{"class":1831},[1659,1861,1862],{"class":1797},"'",[1659,1864,1866],{"class":1865},"sfazB",",",[1659,1868,1862],{"class":1797},[1659,1870,1804],{"class":1831},[1659,1872,637],{"class":1797},[1659,1874,1875],{"class":1789},"map",[1659,1877,1794],{"class":1831},[1659,1879,1880],{"class":1800},"email",[1659,1882,1808],{"class":1807},[1659,1884,1885],{"class":1793}," email",[1659,1887,637],{"class":1797},[1659,1889,1890],{"class":1789},"trim",[1659,1892,1893],{"class":1831},"()",[1659,1895,637],{"class":1797},[1659,1897,1898],{"class":1789},"toLowerCase",[1659,1900,1901],{"class":1831},"())",[1659,1903,637],{"class":1797},[1659,1905,1906],{"class":1789},"filter",[1659,1908,1794],{"class":1831},[1659,1910,1911],{"class":1793},"Boolean",[1659,1913,1914],{"class":1831},"))\n",[1659,1916,1917,1920,1922,1925,1927,1930,1932,1934,1936,1938,1940,1942,1945,1947,1949],{"class":1661,"line":1674},[1659,1918,1919],{"class":1793},"  nitro",[1659,1921,637],{"class":1797},[1659,1923,1924],{"class":1793},"hooks",[1659,1926,637],{"class":1797},[1659,1928,1929],{"class":1789},"hook",[1659,1931,1794],{"class":1831},[1659,1933,1862],{"class":1797},[1659,1935,949],{"class":1865},[1659,1937,1862],{"class":1797},[1659,1939,1866],{"class":1797},[1659,1941,600],{"class":1797},[1659,1943,1944],{"class":1800},"ctx",[1659,1946,1804],{"class":1797},[1659,1948,1808],{"class":1807},[1659,1950,1811],{"class":1797},[1659,1952,1953,1956,1958,1961,1963,1966,1968,1970,1972,1974,1976,1978,1980,1982,1985,1988,1991,1993,1995,1997,1999,2002,2004,2006,2008,2010,2013],{"class":1661,"line":1680},[1659,1954,1955],{"class":1782},"    if",[1659,1957,600],{"class":1831},[1659,1959,1960],{"class":1793},"admins",[1659,1962,637],{"class":1797},[1659,1964,1965],{"class":1789},"has",[1659,1967,1794],{"class":1831},[1659,1969,1944],{"class":1793},[1659,1971,637],{"class":1797},[1659,1973,1604],{"class":1793},[1659,1975,637],{"class":1797},[1659,1977,1880],{"class":1793},[1659,1979,637],{"class":1797},[1659,1981,1898],{"class":1789},[1659,1983,1984],{"class":1831},"()) ",[1659,1986,1987],{"class":1797},"&&",[1659,1989,1990],{"class":1797}," !",[1659,1992,1944],{"class":1793},[1659,1994,637],{"class":1797},[1659,1996,608],{"class":1793},[1659,1998,637],{"class":1797},[1659,2000,2001],{"class":1789},"includes",[1659,2003,1794],{"class":1831},[1659,2005,1862],{"class":1797},[1659,2007,1226],{"class":1865},[1659,2009,1862],{"class":1797},[1659,2011,2012],{"class":1831},")) ",[1659,2014,2015],{"class":1797},"{\n",[1659,2017,2019,2022,2024,2026,2028,2031,2033,2035,2037,2039,2042],{"class":1661,"line":2018},5,[1659,2020,2021],{"class":1793},"      ctx",[1659,2023,637],{"class":1797},[1659,2025,608],{"class":1793},[1659,2027,637],{"class":1797},[1659,2029,2030],{"class":1789},"push",[1659,2032,1794],{"class":1831},[1659,2034,1862],{"class":1797},[1659,2036,1226],{"class":1865},[1659,2038,1862],{"class":1797},[1659,2040,2041],{"class":1831},") ",[1659,2043,2045],{"class":2044},"sHwdD","\u002F\u002F identify the user from ctx.user, never from the session on ctx.event\n",[1659,2047,2049],{"class":1661,"line":2048},6,[1659,2050,2051],{"class":1797},"    }\n",[1659,2053,2055,2058],{"class":1661,"line":2054},7,[1659,2056,2057],{"class":1797},"  }",[1659,2059,2060],{"class":1831},")\n",[1659,2062,2064,2067],{"class":1661,"line":2063},8,[1659,2065,2066],{"class":1797},"}",[1659,2068,2060],{"class":1793},[593,2070,2071,2072,2074,2075,2078,2079,637],{},"Rules that deny (a coordinator may not edit an admin, an email change needs a staff check) become a policy, or an\n",[602,2073,688],{}," listener that calls ",[602,2076,2077],{},"deny()",". See ",[631,2080,209],{"href":210},[639,2082,2084],{"id":2083},"checklist","Checklist",[2086,2087,2088,2092,2103,2107,2141,2351,2355,2371,2375,2388,2392,2409,2413,2425,2429,2445,2502,2508,2512],"steps",{},[698,2089,2091],{"id":2090},"update-the-packages","Update the packages",[593,2093,2094,2095,2098,2099,2102],{},"Upgrade every ",[602,2096,2097],{},"@frigear-nu\u002F*"," package together: ",[602,2100,2101],{},"users"," goes to 3.0, the others take a breaking minor.",[698,2104,2106],{"id":2105},"define-your-roles","Define your roles",[593,2108,2109,2110,729,2113,729,2116,729,2119,729,2121,2124,2125,2127,2128,729,2130,729,2132,1437,2135,2137,2138,637],{},"Replace the ",[602,2111,2112],{},"rbac",[602,2114,2115],{},"roles.hierarchy",[602,2117,2118],{},"inherits",[602,2120,1103],{},[602,2122,2123],{},"labels"," block with ",[602,2126,684],{},", each role with\n",[602,2129,1103],{},[602,2131,1078],{},[602,2133,2134],{},"requirements",[602,2136,1608],{},". Set ",[602,2139,2140],{},"defaultRoles",[1649,2142,2145],{"className":1772,"code":2143,"filename":2144,"language":1775,"meta":1655,"style":1655},"authorization: {\n  defaultRoles: ['user'],\n  roles: {\n    admin: { label: 'Admin', grant: ['*'] },\n    manager: { label: 'Coordinator', grant: ['forms:*', 'users:read', 'users:list'], inherit: ['user'] },\n    user: { label: 'User', grant: ['events:read'] },\n  },\n},\n","nuxt.config.ts",[602,2146,2147,2158,2179,2188,2231,2303,2342,2347],{"__ignoreMap":1655},[1659,2148,2149,2153,2156],{"class":1661,"line":1662},[1659,2150,2152],{"class":2151},"sBMFI","authorization",[1659,2154,2155],{"class":1797},":",[1659,2157,1811],{"class":1797},[1659,2159,2160,2163,2165,2168,2170,2172,2174,2177],{"class":1661,"line":1668},[1659,2161,2162],{"class":2151},"  defaultRoles",[1659,2164,2155],{"class":1797},[1659,2166,2167],{"class":1831}," [",[1659,2169,1862],{"class":1797},[1659,2171,1604],{"class":1865},[1659,2173,1862],{"class":1797},[1659,2175,2176],{"class":1831},"]",[1659,2178,1449],{"class":1797},[1659,2180,2181,2184,2186],{"class":1661,"line":1674},[1659,2182,2183],{"class":2151},"  roles",[1659,2185,2155],{"class":1797},[1659,2187,1811],{"class":1797},[1659,2189,2190,2193,2195,2198,2201,2203,2206,2208,2210,2212,2215,2217,2219,2221,2223,2225,2228],{"class":1661,"line":1680},[1659,2191,2192],{"class":2151},"    admin",[1659,2194,2155],{"class":1797},[1659,2196,2197],{"class":1797}," {",[1659,2199,2200],{"class":2151}," label",[1659,2202,2155],{"class":1797},[1659,2204,2205],{"class":1797}," '",[1659,2207,217],{"class":1865},[1659,2209,1862],{"class":1797},[1659,2211,1866],{"class":1797},[1659,2213,2214],{"class":2151}," grant",[1659,2216,2155],{"class":1797},[1659,2218,2167],{"class":1831},[1659,2220,1862],{"class":1797},[1659,2222,1433],{"class":1865},[1659,2224,1862],{"class":1797},[1659,2226,2227],{"class":1831},"] ",[1659,2229,2230],{"class":1797},"},\n",[1659,2232,2233,2236,2238,2240,2242,2244,2246,2249,2251,2253,2255,2257,2259,2261,2264,2266,2268,2270,2272,2274,2276,2278,2280,2282,2284,2286,2289,2291,2293,2295,2297,2299,2301],{"class":1661,"line":2018},[1659,2234,2235],{"class":2151},"    manager",[1659,2237,2155],{"class":1797},[1659,2239,2197],{"class":1797},[1659,2241,2200],{"class":2151},[1659,2243,2155],{"class":1797},[1659,2245,2205],{"class":1797},[1659,2247,2248],{"class":1865},"Coordinator",[1659,2250,1862],{"class":1797},[1659,2252,1866],{"class":1797},[1659,2254,2214],{"class":2151},[1659,2256,2155],{"class":1797},[1659,2258,2167],{"class":1831},[1659,2260,1862],{"class":1797},[1659,2262,2263],{"class":1865},"forms:*",[1659,2265,1862],{"class":1797},[1659,2267,1866],{"class":1797},[1659,2269,2205],{"class":1797},[1659,2271,1479],{"class":1865},[1659,2273,1862],{"class":1797},[1659,2275,1866],{"class":1797},[1659,2277,2205],{"class":1797},[1659,2279,1475],{"class":1865},[1659,2281,1862],{"class":1797},[1659,2283,2176],{"class":1831},[1659,2285,1866],{"class":1797},[1659,2287,2288],{"class":2151}," inherit",[1659,2290,2155],{"class":1797},[1659,2292,2167],{"class":1831},[1659,2294,1862],{"class":1797},[1659,2296,1604],{"class":1865},[1659,2298,1862],{"class":1797},[1659,2300,2227],{"class":1831},[1659,2302,2230],{"class":1797},[1659,2304,2305,2308,2310,2312,2314,2316,2318,2321,2323,2325,2327,2329,2331,2333,2336,2338,2340],{"class":1661,"line":2048},[1659,2306,2307],{"class":2151},"    user",[1659,2309,2155],{"class":1797},[1659,2311,2197],{"class":1797},[1659,2313,2200],{"class":2151},[1659,2315,2155],{"class":1797},[1659,2317,2205],{"class":1797},[1659,2319,2320],{"class":1865},"User",[1659,2322,1862],{"class":1797},[1659,2324,1866],{"class":1797},[1659,2326,2214],{"class":2151},[1659,2328,2155],{"class":1797},[1659,2330,2167],{"class":1831},[1659,2332,1862],{"class":1797},[1659,2334,2335],{"class":1865},"events:read",[1659,2337,1862],{"class":1797},[1659,2339,2227],{"class":1831},[1659,2341,2230],{"class":1797},[1659,2343,2344],{"class":1661,"line":2054},[1659,2345,2346],{"class":1797},"  },\n",[1659,2348,2349],{"class":1661,"line":2063},[1659,2350,2230],{"class":1797},[698,2352,2354],{"id":2353},"fix-the-build-errors","Fix the build errors",[593,2356,2357,2358,729,2360,2362,2363,729,2365,2367,2368,2370],{},"Route rules with ",[602,2359,608],{},[602,2361,1176],{}," or ",[602,2364,612],{},[602,2366,659],{},", document ",[602,2369,608],{},", and a grant that names an\nunregistered permission all fail the build and say where.",[698,2372,2374],{"id":2373},"replace-the-checks-in-your-server-code","Replace the checks in your server code",[593,2376,2377,2378,2381,2382,2385,2386,637],{},"Swap ",[602,2379,2380],{},"requireAuth({ scopes })",", guards and ability calls for ",[602,2383,2384],{},"authorize",", in the order authorize, load, authorize with\nthe record. See ",[631,2387,121],{"href":122},[698,2389,2391],{"id":2390},"move-the-hooks","Move the hooks",[593,2393,2394,2395,2398,2399,2401,2402,2404,2405,2408],{},"Replace each removed ",[602,2396,2397],{},"*:authorize"," listener with a role grant, a policy or ",[602,2400,688],{},", and the role\nallowlist with ",[602,2403,949],{},". Run ",[602,2406,2407],{},"pnpm dev"," and read the console: a listener on a removed hook name logs a\nwarning.",[698,2410,2412],{"id":2411},"update-the-client","Update the client",[593,2414,2415,2418,2419,2422,2423,637],{},[602,2416,2417],{},"\u003CCan ability>"," becomes ",[602,2420,2421],{},"\u003CCan permission>",". Menu, widget and account items take ",[602,2424,1183],{},[698,2426,2428],{"id":2427},"regenerate-migrations","Regenerate migrations",[593,2430,2431,2432,1437,2434,2436,2437,2440,2441,2444],{},"Authorization adds ",[602,2433,1302],{},[602,2435,1625],{},", auth adds ",[602,2438,2439],{},"auth_user_tokens.permissions",", and\nOAuth Server adds ",[602,2442,2443],{},"oauth_scopes",". Generate and commit migrations for your app, and for every fixture that includes\nthese modules (from the repository root):",[1649,2446,2450],{"className":2447,"code":2448,"language":2449,"meta":1655,"style":1655},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","pnpm --filter @frigear-nu\u002F\u003Cpkg> exec nuxt db generate --cwd \"$PWD\u002Fpackages\u002F\u003Cpkg>\u002Ftest\u002Ffixtures\u002F\u003Cfixture>\"\n","bash",[602,2451,2452],{"__ignoreMap":1655},[1659,2453,2454,2457,2460,2463,2466,2469,2472,2475,2478,2481,2484,2487,2490,2493,2496,2499],{"class":1661,"line":1662},[1659,2455,2456],{"class":2151},"pnpm",[1659,2458,2459],{"class":1865}," --filter",[1659,2461,2462],{"class":1865}," @frigear-nu\u002F",[1659,2464,2465],{"class":1797},"\u003C",[1659,2467,2468],{"class":1865},"pk",[1659,2470,2471],{"class":1793},"g",[1659,2473,2474],{"class":1797},">",[1659,2476,2477],{"class":1865}," exec",[1659,2479,2480],{"class":1865}," nuxt",[1659,2482,2483],{"class":1865}," db",[1659,2485,2486],{"class":1865}," generate",[1659,2488,2489],{"class":1865}," --cwd",[1659,2491,2492],{"class":1797}," \"",[1659,2494,2495],{"class":1793},"$PWD",[1659,2497,2498],{"class":1865},"\u002Fpackages\u002F\u003Cpkg>\u002Ftest\u002Ffixtures\u002F\u003Cfixture>",[1659,2500,2501],{"class":1797},"\"\n",[593,2503,2504,2505,637],{},"Run it again after: it must print ",[602,2506,2507],{},"No schema changes, nothing to migrate",[698,2509,2511],{"id":2510},"verify-the-data-and-the-access","Verify the data and the access",[593,2513,2514,2515,2517,2518,2520,2521,2523,2524,637],{},"Run the SQL above, sign in as each kind of user, and call ",[602,2516,1024],{},": ",[602,2519,599],{}," must be what you\nexpect. Try one token with only ",[602,2522,1396],{}," against a staff route: it answers ",[602,2525,2526],{},"403 insufficient_scope",[639,2528,2530],{"id":2529},"next-steps","Next steps",[644,2532,2533,2538,2543],{},[647,2534,2535,2537],{},[631,2536,67],{"href":68}," – the vocabulary, the decision order and the fail-closed table.",[647,2539,2540,2542],{},[631,2541,482],{"href":483}," – the two-step route in practice.",[647,2544,2545,2548],{},[631,2546,2547],{"href":542},"Register permissions in a module"," – for module authors.",[2550,2551,2552],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}",{"title":1655,"searchDepth":1668,"depth":1668,"links":2554},[2555,2556,2561,2562,2563,2565,2575],{"id":641,"depth":1668,"text":642},{"id":695,"depth":1668,"text":696,"children":2557},[2558,2559,2560],{"id":700,"depth":1674,"text":701},{"id":1031,"depth":1674,"text":26},{"id":1309,"depth":1674,"text":213},{"id":1377,"depth":1668,"text":1378},{"id":1581,"depth":1668,"text":1582},{"id":1748,"depth":1668,"text":2564},"Move an allowlist to authorization:roles",{"id":2083,"depth":1668,"text":2084,"children":2566},[2567,2568,2569,2570,2571,2572,2573,2574],{"id":2090,"depth":1674,"text":2091},{"id":2105,"depth":1674,"text":2106},{"id":2353,"depth":1674,"text":2354},{"id":2373,"depth":1674,"text":2374},{"id":2390,"depth":1674,"text":2391},{"id":2411,"depth":1674,"text":2412},{"id":2427,"depth":1674,"text":2428},{"id":2510,"depth":1674,"text":2511},{"id":2529,"depth":1668,"text":2530},"Move a host app or module from abilities, role-name checks, RBAC and per-module authorize hooks to permissions, roles, scopes and policies.","md",null,{},{"icon":154},{"title":151,"description":2576},"Fqj1_4osqh9Mq0a8G2USw9t0tihXywQgRQ-2__Z_SIY",[2584,2586],{"title":146,"path":147,"stem":148,"description":2585,"icon":149,"children":-1},"Set up the Stripe dashboard, webhook endpoint, keys and KV once, so Stripe, Payments and Subscriptions all work, in production and locally.",{"title":156,"path":158,"stem":162,"description":2587,"children":-1},"Which Frigear module gives your app each feature, what each one does and which others it installs for you.",1794503147536]