[{"data":1,"prerenderedAt":1918},["ShallowReactive",2],{"navigation_docs":3,"-modules-identity-authorization-client":587,"-modules-identity-authorization-client-surround":1913},[4,50,155,441,504],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":49},"Get Started","i-lucide-rocket","\u002Fget-started","1.get-started",[10,15,20,25,30,35,40,45],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fget-started\u002Fintroduction","1.get-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Installation","\u002Fget-started\u002Finstallation","1.get-started\u002F2.installation","i-lucide-download",{"title":21,"path":22,"stem":23,"icon":24},"Project structure","\u002Fget-started\u002Fproject-structure","1.get-started\u002F3.project-structure","i-lucide-folder-tree",{"title":26,"path":27,"stem":28,"icon":29},"Configuration","\u002Fget-started\u002Fconfiguration","1.get-started\u002F4.configuration","i-lucide-settings",{"title":31,"path":32,"stem":33,"icon":34},"Authentication","\u002Fget-started\u002Fauthentication","1.get-started\u002F5.authentication","i-lucide-lock",{"title":36,"path":37,"stem":38,"icon":39},"Adding modules","\u002Fget-started\u002Fadding-modules","1.get-started\u002F6.adding-modules","i-lucide-puzzle",{"title":41,"path":42,"stem":43,"icon":44},"Database","\u002Fget-started\u002Fdatabase","1.get-started\u002F7.database","i-lucide-database",{"title":46,"path":47,"stem":48,"icon":6},"Deployment","\u002Fget-started\u002Fdeployment","1.get-started\u002F8.deployment",false,{"title":51,"icon":52,"path":53,"stem":54,"children":55,"page":49},"Guide","i-lucide-book-open","\u002Fguide","2.guide",[56,90,115,125],{"title":57,"icon":49,"path":58,"stem":59,"children":60,"page":49},"Concepts","\u002Fguide\u002Fconcepts","2.guide\u002F1.concepts",[61,66,71,76,80,85],{"title":62,"path":63,"stem":64,"icon":65},"Architecture","\u002Fguide\u002Fconcepts\u002Farchitecture","2.guide\u002F1.concepts\u002F1.architecture","i-lucide-blocks",{"title":67,"path":68,"stem":69,"icon":70},"Access control","\u002Fguide\u002Fconcepts\u002Fauth-and-scopes","2.guide\u002F1.concepts\u002F2.auth-and-scopes","i-lucide-shield-check",{"title":72,"path":73,"stem":74,"icon":75},"Extension points","\u002Fguide\u002Fconcepts\u002Fextension-points","2.guide\u002F1.concepts\u002F3.extension-points","i-lucide-plug",{"title":77,"path":78,"stem":79,"icon":44},"Database extensions","\u002Fguide\u002Fconcepts\u002Fdatabase-extensions","2.guide\u002F1.concepts\u002F4.database-extensions",{"title":81,"path":82,"stem":83,"icon":84},"Identity","\u002Fguide\u002Fconcepts\u002Fidentity","2.guide\u002F1.concepts\u002F5.identity","i-lucide-fingerprint",{"title":86,"path":87,"stem":88,"icon":89},"Glossary","\u002Fguide\u002Fconcepts\u002Fglossary","2.guide\u002F1.concepts\u002F6.glossary","i-lucide-book-a",{"title":91,"icon":49,"path":92,"stem":93,"children":94,"page":49},"UX patterns","\u002Fguide\u002Fux-patterns","2.guide\u002F2.ux-patterns",[95,100,105,110],{"title":96,"path":97,"stem":98,"icon":99},"Layouts and navigation","\u002Fguide\u002Fux-patterns\u002Flayouts-and-navigation","2.guide\u002F2.ux-patterns\u002F1.layouts-and-navigation","i-lucide-layout-template",{"title":101,"path":102,"stem":103,"icon":104},"Pages","\u002Fguide\u002Fux-patterns\u002Fpages","2.guide\u002F2.ux-patterns\u002F2.pages","i-lucide-table",{"title":106,"path":107,"stem":108,"icon":109},"Forms and actions","\u002Fguide\u002Fux-patterns\u002Fforms-and-actions","2.guide\u002F2.ux-patterns\u002F3.forms-and-actions","i-lucide-square-pen",{"title":111,"path":112,"stem":113,"icon":114},"Text and formatting","\u002Fguide\u002Fux-patterns\u002Ftext-and-formatting","2.guide\u002F2.ux-patterns\u002F4.text-and-formatting","i-lucide-type",{"title":116,"icon":49,"path":117,"stem":118,"children":119,"page":49},"Best practices","\u002Fguide\u002Fbest-practices","2.guide\u002F3.best-practices",[120],{"title":121,"path":122,"stem":123,"icon":124},"HTTP routes","\u002Fguide\u002Fbest-practices\u002Fhttp-routes","2.guide\u002F3.best-practices\u002F1.http-routes","i-lucide-route",{"title":126,"icon":49,"path":127,"stem":128,"children":129,"page":49},"Going further","\u002Fguide\u002Fgoing-further","2.guide\u002F4.going-further",[130,135,140,145,150],{"title":131,"path":132,"stem":133,"icon":134},"Use your own OAuth server","\u002Fguide\u002Fgoing-further\u002Fown-oauth-server","2.guide\u002F4.going-further\u002F1.own-oauth-server","i-lucide-key-round",{"title":136,"path":137,"stem":138,"icon":139},"Create an OAuth application","\u002Fguide\u002Fgoing-further\u002Foauth-application","2.guide\u002F4.going-further\u002F2.oauth-application","i-lucide-app-window",{"title":141,"path":142,"stem":143,"icon":144},"Signing keys","\u002Fguide\u002Fgoing-further\u002Fsigning-keys","2.guide\u002F4.going-further\u002F3.signing-keys","i-lucide-key-square",{"title":146,"path":147,"stem":148,"icon":149},"Stripe setup","\u002Fguide\u002Fgoing-further\u002Fstripe-setup","2.guide\u002F4.going-further\u002F4.stripe-setup","i-lucide-credit-card",{"title":151,"path":152,"stem":153,"icon":154},"Migrate to the permission model","\u002Fguide\u002Fgoing-further\u002Fmigrate-access-control","2.guide\u002F4.going-further\u002F5.migrate-access-control","i-lucide-arrow-right-left",{"title":156,"icon":157,"path":158,"stem":159,"children":160},"Modules","i-lucide-boxes","\u002Fmodules","3.modules",[161,163,244,273,320,375],{"title":156,"path":158,"stem":162},"3.modules\u002Findex",{"title":81,"icon":49,"path":164,"stem":165,"children":166,"page":49},"\u002Fmodules\u002Fidentity","3.modules\u002F1.identity",[167,190,194,198,220,224,240],{"title":168,"path":169,"stem":170,"children":171},"Auth","\u002Fmodules\u002Fidentity\u002Fauth","3.modules\u002F1.identity\u002F1.auth\u002Findex",[172,174,178,182,186],{"title":173,"path":169,"stem":170},"Overview",{"title":175,"path":176,"stem":177},"Server API","\u002Fmodules\u002Fidentity\u002Fauth\u002Fserver","3.modules\u002F1.identity\u002F1.auth\u002F2.server",{"title":179,"path":180,"stem":181},"Reference","\u002Fmodules\u002Fidentity\u002Fauth\u002Freference","3.modules\u002F1.identity\u002F1.auth\u002F3.reference",{"title":183,"path":184,"stem":185},"Client mode","\u002Fmodules\u002Fidentity\u002Fauth\u002Fclient-mode","3.modules\u002F1.identity\u002F1.auth\u002F4.client-mode",{"title":187,"path":188,"stem":189},"OAuth providers","\u002Fmodules\u002Fidentity\u002Fauth\u002Foauth-providers","3.modules\u002F1.identity\u002F1.auth\u002F5.oauth-providers",{"title":191,"path":192,"stem":193},"Users","\u002Fmodules\u002Fidentity\u002Fusers","3.modules\u002F1.identity\u002F2.users",{"title":195,"path":196,"stem":197},"Account","\u002Fmodules\u002Fidentity\u002Faccount","3.modules\u002F1.identity\u002F3.account",{"title":199,"path":200,"stem":201,"children":202},"Authorization","\u002Fmodules\u002Fidentity\u002Fauthorization","3.modules\u002F1.identity\u002F4.authorization\u002Findex",[203,204,208,212,216],{"title":173,"path":200,"stem":201},{"title":205,"path":206,"stem":207},"Roles and requirements","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Froles-and-requirements","3.modules\u002F1.identity\u002F4.authorization\u002F2.roles-and-requirements",{"title":209,"path":210,"stem":211},"Policies","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fpolicies","3.modules\u002F1.identity\u002F4.authorization\u002F3.policies",{"title":213,"path":214,"stem":215},"Client","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fclient","3.modules\u002F1.identity\u002F4.authorization\u002F4.client",{"title":217,"path":218,"stem":219},"Admin","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fadmin","3.modules\u002F1.identity\u002F4.authorization\u002F5.admin",{"title":221,"path":222,"stem":223},"Preferences","\u002Fmodules\u002Fidentity\u002Fpreferences","3.modules\u002F1.identity\u002F5.preferences",{"title":225,"path":226,"stem":227,"children":228},"OAuth Server","\u002Fmodules\u002Fidentity\u002Foauth-server","3.modules\u002F1.identity\u002F6.oauth-server\u002Findex",[229,230,233,237],{"title":173,"path":226,"stem":227},{"title":175,"path":231,"stem":232},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fserver","3.modules\u002F1.identity\u002F6.oauth-server\u002F2.server",{"title":234,"path":235,"stem":236},"Hooks","\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fhooks","3.modules\u002F1.identity\u002F6.oauth-server\u002F3.hooks",{"title":179,"path":238,"stem":239},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Froutes-and-clients","3.modules\u002F1.identity\u002F6.oauth-server\u002F4.routes-and-clients",{"title":241,"path":242,"stem":243},"OAuth Resource","\u002Fmodules\u002Fidentity\u002Foauth-resource","3.modules\u002F1.identity\u002F8.oauth-resource",{"title":245,"icon":49,"path":246,"stem":247,"children":248,"page":49},"Commerce","\u002Fmodules\u002Fcommerce","3.modules\u002F2.commerce",[249,253,257],{"title":250,"path":251,"stem":252},"Stripe","\u002Fmodules\u002Fcommerce\u002Fstripe","3.modules\u002F2.commerce\u002F1.stripe",{"title":254,"path":255,"stem":256},"Payments","\u002Fmodules\u002Fcommerce\u002Fpayments","3.modules\u002F2.commerce\u002F2.payments",{"title":258,"path":259,"stem":260,"children":261},"Subscriptions","\u002Fmodules\u002Fcommerce\u002Fsubscriptions","3.modules\u002F2.commerce\u002F3.subscriptions\u002Findex",[262,263,266,270],{"title":173,"path":259,"stem":260},{"title":175,"path":264,"stem":265},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fserver","3.modules\u002F2.commerce\u002F3.subscriptions\u002F2.server",{"title":267,"path":268,"stem":269},"App","\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fapp","3.modules\u002F2.commerce\u002F3.subscriptions\u002F3.app",{"title":179,"path":271,"stem":272},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Freference","3.modules\u002F2.commerce\u002F3.subscriptions\u002F4.reference",{"title":274,"icon":49,"path":275,"stem":276,"children":277,"page":49},"Features","\u002Fmodules\u002Ffeatures","3.modules\u002F3.features",[278,293,312,316],{"title":279,"path":280,"stem":281,"children":282},"Events","\u002Fmodules\u002Ffeatures\u002Fevents","3.modules\u002F3.features\u002F1.events\u002Findex",[283,284,287,290],{"title":173,"path":280,"stem":281},{"title":175,"path":285,"stem":286},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fserver","3.modules\u002F3.features\u002F1.events\u002F2.server",{"title":267,"path":288,"stem":289},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fapp","3.modules\u002F3.features\u002F1.events\u002F3.app",{"title":179,"path":291,"stem":292},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Freference","3.modules\u002F3.features\u002F1.events\u002F4.reference",{"title":294,"path":295,"stem":296,"children":297},"Forms","\u002Fmodules\u002Ffeatures\u002Fforms","3.modules\u002F3.features\u002F2.forms\u002Findex",[298,299,303,306,309],{"title":173,"path":295,"stem":296},{"title":300,"path":301,"stem":302},"Definition","\u002Fmodules\u002Ffeatures\u002Fforms\u002Fdefinition","3.modules\u002F3.features\u002F2.forms\u002F2.definition",{"title":175,"path":304,"stem":305},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fserver","3.modules\u002F3.features\u002F2.forms\u002F3.server",{"title":267,"path":307,"stem":308},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fapp","3.modules\u002F3.features\u002F2.forms\u002F4.app",{"title":179,"path":310,"stem":311},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Freference","3.modules\u002F3.features\u002F2.forms\u002F5.reference",{"title":313,"path":314,"stem":315},"Cookie Consent","\u002Fmodules\u002Ffeatures\u002Fcookie-consent","3.modules\u002F3.features\u002F3.cookie-consent",{"title":317,"path":318,"stem":319},"MCP","\u002Fmodules\u002Ffeatures\u002Fmcp","3.modules\u002F3.features\u002F4.mcp",{"title":321,"icon":49,"path":322,"stem":323,"children":324,"page":49},"Interface","\u002Fmodules\u002Finterface","3.modules\u002F4.interface",[325,350,353,357,361],{"title":326,"path":327,"stem":328,"children":329},"UI","\u002Fmodules\u002Finterface\u002Fui","3.modules\u002F4.interface\u002F1.ui\u002Findex",[330,331,335,339,343,347],{"title":173,"path":327,"stem":328},{"title":332,"path":333,"stem":334},"Page components","\u002Fmodules\u002Finterface\u002Fui\u002Fpage-components","3.modules\u002F4.interface\u002F1.ui\u002F2.page-components",{"title":336,"path":337,"stem":338},"App shell","\u002Fmodules\u002Finterface\u002Fui\u002Fapp-shell","3.modules\u002F4.interface\u002F1.ui\u002F3.app-shell",{"title":340,"path":341,"stem":342},"Form inputs","\u002Fmodules\u002Finterface\u002Fui\u002Fform-inputs","3.modules\u002F4.interface\u002F1.ui\u002F4.form-inputs",{"title":344,"path":345,"stem":346},"Composables and helpers","\u002Fmodules\u002Finterface\u002Fui\u002Fcomposables","3.modules\u002F4.interface\u002F1.ui\u002F5.composables",{"title":179,"path":348,"stem":349},"\u002Fmodules\u002Finterface\u002Fui\u002Freference","3.modules\u002F4.interface\u002F1.ui\u002F6.reference",{"title":217,"path":351,"stem":352},"\u002Fmodules\u002Finterface\u002Fadmin","3.modules\u002F4.interface\u002F2.admin",{"title":354,"path":355,"stem":356},"Menu","\u002Fmodules\u002Finterface\u002Fmenu","3.modules\u002F4.interface\u002F3.menu",{"title":358,"path":359,"stem":360},"Widget","\u002Fmodules\u002Finterface\u002Fwidget","3.modules\u002F4.interface\u002F4.widget",{"title":362,"path":363,"stem":364,"children":365},"Mobile","\u002Fmodules\u002Finterface\u002Fmobile","3.modules\u002F4.interface\u002F5.mobile\u002Findex",[366,367,371],{"title":173,"path":363,"stem":364},{"title":368,"path":369,"stem":370},"CLI and devices","\u002Fmodules\u002Finterface\u002Fmobile\u002Fcli-and-devices","3.modules\u002F4.interface\u002F5.mobile\u002F2.cli-and-devices",{"title":372,"path":373,"stem":374},"Splash screen","\u002Fmodules\u002Finterface\u002Fmobile\u002Fsplash-screen","3.modules\u002F4.interface\u002F5.mobile\u002F3.splash-screen",{"title":376,"icon":49,"path":377,"stem":378,"children":379,"page":49},"Platform","\u002Fmodules\u002Fplatform","3.modules\u002F5.platform",[380,402,406,423],{"title":381,"path":382,"stem":383,"children":384},"Module Kit","\u002Fmodules\u002Fplatform\u002Fmodule-kit","3.modules\u002F5.platform\u002F1.module-kit\u002Findex",[385,386,390,394,398],{"title":173,"path":382,"stem":383},{"title":387,"path":388,"stem":389},"Server toolkit","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fserver-toolkit","3.modules\u002F5.platform\u002F1.module-kit\u002F2.server-toolkit",{"title":391,"path":392,"stem":393},"Registries and menus","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fregistries-and-menus","3.modules\u002F5.platform\u002F1.module-kit\u002F3.registries-and-menus",{"title":395,"path":396,"stem":397},"Translations","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fi18n","3.modules\u002F5.platform\u002F1.module-kit\u002F4.i18n",{"title":399,"path":400,"stem":401},"Database helpers","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fdatabase","3.modules\u002F5.platform\u002F1.module-kit\u002F5.database",{"title":403,"path":404,"stem":405},"Notify","\u002Fmodules\u002Fplatform\u002Fnotify","3.modules\u002F5.platform\u002F2.notify",{"title":407,"path":408,"stem":409,"children":410},"Email Templates","\u002Fmodules\u002Fplatform\u002Femail-templates","3.modules\u002F5.platform\u002F3.email-templates\u002Findex",[411,412,416,419],{"title":173,"path":408,"stem":409},{"title":413,"path":414,"stem":415},"Email components","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fcomponents","3.modules\u002F5.platform\u002F3.email-templates\u002F2.components",{"title":175,"path":417,"stem":418},"\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fserver","3.modules\u002F5.platform\u002F3.email-templates\u002F3.server",{"title":420,"path":421,"stem":422},"Module emails","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fmodule-emails","3.modules\u002F5.platform\u002F3.email-templates\u002F4.module-emails",{"title":424,"path":425,"stem":426,"children":427},"Base Layer","\u002Fmodules\u002Fplatform\u002Fbase-layer","3.modules\u002F5.platform\u002F4.base-layer\u002Findex",[428,429,433,437],{"title":173,"path":425,"stem":426},{"title":430,"path":431,"stem":432},"Content collections","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcontent-collections","3.modules\u002F5.platform\u002F4.base-layer\u002F2.content-collections",{"title":434,"path":435,"stem":436},"Layouts and routing","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Flayouts-and-routing","3.modules\u002F5.platform\u002F4.base-layer\u002F3.layouts-and-routing",{"title":438,"path":439,"stem":440},"Composables and utils","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcomposables-and-utils","3.modules\u002F5.platform\u002F4.base-layer\u002F4.composables-and-utils",{"title":442,"icon":443,"path":444,"stem":445,"children":446,"page":49},"Examples","i-lucide-code-xml","\u002Fexamples","4.examples",[447,466,476],{"title":448,"icon":49,"path":449,"stem":450,"children":451,"page":49},"Starters","\u002Fexamples\u002Fstarters","4.examples\u002F1.starters",[452,456,461],{"title":453,"path":454,"stem":455,"icon":6},"Workspace starter","\u002Fexamples\u002Fstarters\u002Fworkspace","4.examples\u002F1.starters\u002F1.workspace",{"title":457,"path":458,"stem":459,"icon":460},"Mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile","4.examples\u002F1.starters\u002F2.mobile","i-lucide-smartphone",{"title":462,"path":463,"stem":464,"icon":465},"Standalone mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile-standalone","4.examples\u002F1.starters\u002F3.mobile-standalone","i-lucide-tablet-smartphone",{"title":467,"icon":49,"path":468,"stem":469,"children":470,"page":49},"Apps","\u002Fexamples\u002Fapps","4.examples\u002F2.apps",[471],{"title":472,"path":473,"stem":474,"icon":475},"Frigear website app","\u002Fexamples\u002Fapps\u002Ffrigear-nu-website","4.examples\u002F2.apps\u002F1.frigear-nu-website","i-lucide-layout-dashboard",{"title":477,"icon":49,"path":478,"stem":479,"children":480,"page":49},"Tasks","\u002Fexamples\u002Ftasks","4.examples\u002F3.tasks",[481,485,489,494,499],{"title":482,"path":483,"stem":484,"icon":70},"Protect a route","\u002Fexamples\u002Ftasks\u002Fprotect-a-route","4.examples\u002F3.tasks\u002F1.protect-a-route",{"title":486,"path":487,"stem":488,"icon":475},"Add an admin page","\u002Fexamples\u002Ftasks\u002Fadd-an-admin-page","4.examples\u002F3.tasks\u002F2.add-an-admin-page",{"title":490,"path":491,"stem":492,"icon":493},"Sell event tickets","\u002Fexamples\u002Ftasks\u002Fsell-event-tickets","4.examples\u002F3.tasks\u002F3.sell-event-tickets","i-lucide-ticket",{"title":495,"path":496,"stem":497,"icon":498},"Build a form","\u002Fexamples\u002Ftasks\u002Fbuild-a-form","4.examples\u002F3.tasks\u002F4.build-a-form","i-lucide-clipboard-list",{"title":500,"path":501,"stem":502,"icon":503},"Send an email","\u002Fexamples\u002Ftasks\u002Fsend-an-email","4.examples\u002F3.tasks\u002F5.send-an-email","i-lucide-mail",{"title":505,"icon":506,"path":507,"stem":508,"children":509,"page":49},"Contribute","i-lucide-git-pull-request","\u002Fcontribute","5.contribute",[510,513,518,544,549,552,556,571],{"title":173,"path":511,"stem":512,"icon":506},"\u002Fcontribute\u002Foverview","5.contribute\u002F1.overview",{"title":514,"path":515,"stem":516,"icon":517},"Local development","\u002Fcontribute\u002Flocal-development","5.contribute\u002F2.local-development","i-lucide-terminal",{"title":519,"icon":49,"path":520,"stem":521,"children":522,"page":49},"Writing a module","\u002Fcontribute\u002Fwriting-a-module","5.contribute\u002F3.writing-a-module",[523,527,532,536,541],{"title":524,"path":525,"stem":526,"icon":39},"Scaffold a module","\u002Fcontribute\u002Fwriting-a-module\u002Fscaffold","5.contribute\u002F3.writing-a-module\u002F1.scaffold",{"title":528,"path":529,"stem":530,"icon":531},"Setup checklist","\u002Fcontribute\u002Fwriting-a-module\u002Fsetup-checklist","5.contribute\u002F3.writing-a-module\u002F2.setup-checklist","i-lucide-list-checks",{"title":533,"path":534,"stem":535,"icon":44},"Database tables","\u002Fcontribute\u002Fwriting-a-module\u002Fdatabase-tables","5.contribute\u002F3.writing-a-module\u002F3.database-tables",{"title":537,"path":538,"stem":539,"icon":540},"Testing","\u002Fcontribute\u002Fwriting-a-module\u002Ftesting","5.contribute\u002F3.writing-a-module\u002F4.testing","i-lucide-flask-conical",{"title":67,"path":542,"stem":543,"icon":70},"\u002Fcontribute\u002Fwriting-a-module\u002Faccess-control","5.contribute\u002F3.writing-a-module\u002F5.access-control",{"title":545,"path":546,"stem":547,"icon":548},"Publishing","\u002Fcontribute\u002Fpublishing","5.contribute\u002F4.publishing","i-lucide-package-check",{"title":448,"path":550,"stem":551,"icon":6},"\u002Fcontribute\u002Fstarters","5.contribute\u002F5.starters",{"title":553,"path":554,"stem":555,"icon":52},"Documentation","\u002Fcontribute\u002Fdocumentation","5.contribute\u002F6.documentation",{"title":557,"icon":49,"path":558,"stem":559,"children":560,"page":49},"Tooling","\u002Fcontribute\u002Ftooling","5.contribute\u002F7.tooling",[561,566],{"title":562,"path":563,"stem":564,"icon":565},"CLI","\u002Fcontribute\u002Ftooling\u002Fcli","5.contribute\u002F7.tooling\u002F1.cli","i-lucide-square-terminal",{"title":567,"path":568,"stem":569,"icon":570},"ESLint config","\u002Fcontribute\u002Ftooling\u002Feslint-config","5.contribute\u002F7.tooling\u002F2.eslint-config","i-lucide-spell-check",{"title":572,"icon":49,"path":573,"stem":574,"children":575},"Decisions","\u002Fcontribute\u002Fdecisions","5.contribute\u002F8.decisions\u002Findex",[576,578,583],{"title":572,"path":573,"stem":574,"icon":577},"i-lucide-scale",{"title":579,"path":580,"stem":581,"icon":582},"Session lifetimes per OAuth client","\u002Fcontribute\u002Fdecisions\u002Foauth-token-lifetimes","5.contribute\u002F8.decisions\u002F1.oauth-token-lifetimes","i-lucide-timer",{"title":584,"path":585,"stem":586,"icon":70},"One permission model","\u002Fcontribute\u002Fdecisions\u002Fpermission-model","5.contribute\u002F8.decisions\u002F2.permission-model",{"id":588,"title":213,"body":589,"description":1906,"extension":1907,"links":1908,"meta":1909,"navigation":1910,"path":214,"seo":1911,"stem":215,"__hash__":1912},"docs\u002F3.modules\u002F1.identity\u002F4.authorization\u002F4.client.md",{"type":590,"value":591,"toc":1894},"minimark",[592,605,614,621,681,792,938,991,1001,1090,1113,1117,1129,1311,1372,1463,1468,1484,1511,1515,1525,1588,1594,1668,1693,1697,1719,1769,1772,1775,1792,1845,1853,1862,1866,1890],[593,594,595,596,601,602,604],"p",{},"The browser needs to know what to show: which buttons, menu items and pages. This page covers the composable and\ncomponents that answer that, the route rules that guard pages, and how the same code works in\n",[597,598,600],"a",{"href":599},"#client-mode","client mode"," and mobile apps. Set up the module first: ",[597,603,173],{"href":200},".",[606,607,608,609,613],"warning",{},"Checks in the app only shape the interface. The API decides what is allowed: enforce every permission on the server\nwith ",[610,611,612],"code",{},"authorize(event, ...)"," or route rules.",[615,616,618],"h2",{"id":617},"useauthorization",[610,619,620],{},"useAuthorization()",[622,623,628],"pre",{"className":624,"code":625,"language":626,"meta":627,"style":627},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","const { access, can, cannot, authorize, refresh } = useAuthorization()\n","ts","",[610,629,630],{"__ignoreMap":627},[631,632,635,639,643,647,650,653,655,658,660,663,665,668,671,674,678],"span",{"class":633,"line":634},"line",1,[631,636,638],{"class":637},"spNyl","const",[631,640,642],{"class":641},"sMK4o"," {",[631,644,646],{"class":645},"sTEyZ"," access",[631,648,649],{"class":641},",",[631,651,652],{"class":645}," can",[631,654,649],{"class":641},[631,656,657],{"class":645}," cannot",[631,659,649],{"class":641},[631,661,662],{"class":645}," authorize",[631,664,649],{"class":641},[631,666,667],{"class":645}," refresh ",[631,669,670],{"class":641},"}",[631,672,673],{"class":641}," =",[631,675,677],{"class":676},"s2Zo4"," useAuthorization",[631,679,680],{"class":645},"()\n",[682,683,684,697],"table",{},[685,686,687],"thead",{},[688,689,690,694],"tr",{},[691,692,693],"th",{},"Name",[691,695,696],{},"Behaviour",[698,699,700,722,745,758,779],"tbody",{},[688,701,702,708],{},[703,704,705],"td",{},[610,706,707],{},"access",[703,709,710,713,714,717,718,721],{},[610,711,712],{},"{ kind, scopes, permissions, roles? }"," as ",[610,715,716],{},"GET \u002Fapi\u002Fauth\u002Fme\u002Faccess"," answers it, or ",[610,719,720],{},"null"," for visitors.",[688,723,724,729],{},[703,725,726],{},[610,727,728],{},"can(permission, record?)",[703,730,731,735,736,739,740,744],{},[732,733,734],"strong",{},"Synchronous."," Whether the exact ",[610,737,738],{},"access.permissions"," list holds the permission, then the ",[597,741,743],{"href":742},"\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fpolicies#shared-policies","shared policies"," for it, which can only deny.",[688,746,747,752],{},[703,748,749],{},[610,750,751],{},"cannot(permission, record?)",[703,753,754,755,604],{},"The opposite of ",[610,756,757],{},"can",[688,759,760,765],{},[703,761,762],{},[610,763,764],{},"authorize(permission, record?)",[703,766,767,768,770,771,774,775,778],{},"Throws a Nuxt error when ",[610,769,757],{}," is false: ",[610,772,773],{},"401"," for visitors, ",[610,776,777],{},"403"," otherwise. Use it in a page or action.",[688,780,781,786],{},[703,782,783],{},[610,784,785],{},"refresh()",[703,787,788,789,791],{},"Fetches ",[610,790,707],{}," again, and makes menus, tabs and widgets filter again.",[622,793,797],{"className":794,"code":795,"language":796,"meta":627,"style":627},"language-vue shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u003Cscript setup lang=\"ts\">\nconst { can } = useAuthorization()\n\u003C\u002Fscript>\n\n\u003Ctemplate>\n  \u003CUButton v-if=\"can('posts:update', post)\" label=\"Edit post\" \u002F>\n\u003C\u002Ftemplate>\n","vue",[610,798,799,828,846,856,863,873,929],{"__ignoreMap":627},[631,800,801,804,808,811,814,817,820,823,825],{"class":633,"line":634},[631,802,803],{"class":641},"\u003C",[631,805,807],{"class":806},"swJcz","script",[631,809,810],{"class":637}," setup",[631,812,813],{"class":637}," lang",[631,815,816],{"class":641},"=",[631,818,819],{"class":641},"\"",[631,821,626],{"class":822},"sfazB",[631,824,819],{"class":641},[631,826,827],{"class":641},">\n",[631,829,831,833,835,838,840,842,844],{"class":633,"line":830},2,[631,832,638],{"class":637},[631,834,642],{"class":641},[631,836,837],{"class":645}," can ",[631,839,670],{"class":641},[631,841,673],{"class":641},[631,843,677],{"class":676},[631,845,680],{"class":645},[631,847,849,852,854],{"class":633,"line":848},3,[631,850,851],{"class":641},"\u003C\u002F",[631,853,807],{"class":806},[631,855,827],{"class":641},[631,857,859],{"class":633,"line":858},4,[631,860,862],{"emptyLinePlaceholder":861},true,"\n",[631,864,866,868,871],{"class":633,"line":865},5,[631,867,803],{"class":641},[631,869,870],{"class":806},"template",[631,872,827],{"class":641},[631,874,876,879,882,886,888,890,892,895,898,901,903,906,909,912,914,917,919,921,924,926],{"class":633,"line":875},6,[631,877,878],{"class":641},"  \u003C",[631,880,881],{"class":806},"UButton",[631,883,885],{"class":884},"s7zQu"," v-if",[631,887,816],{"class":641},[631,889,819],{"class":641},[631,891,757],{"class":676},[631,893,894],{"class":641},"(",[631,896,897],{"class":641},"'",[631,899,900],{"class":822},"posts:update",[631,902,897],{"class":641},[631,904,905],{"class":641},", ",[631,907,908],{"class":645},"post",[631,910,911],{"class":641},")",[631,913,819],{"class":641},[631,915,916],{"class":637}," label",[631,918,816],{"class":641},[631,920,819],{"class":641},[631,922,923],{"class":822},"Edit post",[631,925,819],{"class":641},[631,927,928],{"class":641}," \u002F>\n",[631,930,932,934,936],{"class":633,"line":931},7,[631,933,851],{"class":641},[631,935,870],{"class":806},[631,937,827],{"class":641},[939,940,941,955,967,973],"ul",{},[942,943,944,950,951,954],"li",{},[732,945,946,947,949],{},"Where ",[610,948,707],{}," comes from."," It is fetched during server rendering, so the first paint and the page middleware\nagree, kept in ",[610,952,953],{},"useState",", and fetched again when the signed-in user changes (sign-in, sign-out, switching accounts).",[942,956,957,962,963,966],{},[732,958,959,961],{},[610,960,757],{}," needs the exact name."," The list holds registered permissions, so ",[610,964,965],{},"can('events:*')"," is false: ask for the\npermission you mean.",[942,968,969,972],{},[732,970,971],{},"Unregistered or unknown permissions"," are false. Typos fail closed.",[942,974,975,978,979,982,983,985,986,990],{},[732,976,977],{},"A policy that needs a record"," is only reflected when you pass it: ",[610,980,981],{},"permissions"," in ",[610,984,707],{}," is what a check\n",[987,988,989],"em",{},"without"," a record allows.",[615,992,994,997,998],{"id":993},"can-and-cannot",[610,995,996],{},"\u003CCan>"," and ",[610,999,1000],{},"\u003CCannot>",[622,1002,1004],{"className":794,"code":1003,"language":796,"meta":627,"style":627},"\u003CCan permission=\"events:update\" :record=\"ev\">\n  \u003Cbutton>Edit\u003C\u002Fbutton>\n  \u003Ctemplate #fallback>\u003Cspan>Read only\u003C\u002Fspan>\u003C\u002Ftemplate>\n\u003C\u002FCan>\n\u003CCannot permission=\"admin:access\">You are not an administrator.\u003C\u002FCannot>\n",[610,1005,1006,1042,1047,1052,1060],{"__ignoreMap":627},[631,1007,1008,1010,1013,1016,1018,1020,1023,1025,1028,1031,1033,1035,1038,1040],{"class":633,"line":634},[631,1009,803],{"class":641},[631,1011,1012],{"class":806},"Can",[631,1014,1015],{"class":637}," permission",[631,1017,816],{"class":641},[631,1019,819],{"class":641},[631,1021,1022],{"class":822},"events:update",[631,1024,819],{"class":641},[631,1026,1027],{"class":641}," :",[631,1029,1030],{"class":637},"record",[631,1032,816],{"class":641},[631,1034,819],{"class":641},[631,1036,1037],{"class":645},"ev",[631,1039,819],{"class":641},[631,1041,827],{"class":641},[631,1043,1044],{"class":633,"line":830},[631,1045,1046],{"class":645},"  \u003Cbutton>Edit\u003C\u002Fbutton>\n",[631,1048,1049],{"class":633,"line":848},[631,1050,1051],{"class":645},"  \u003Ctemplate #fallback>\u003Cspan>Read only\u003C\u002Fspan>\u003C\u002Ftemplate>\n",[631,1053,1054,1056,1058],{"class":633,"line":858},[631,1055,851],{"class":641},[631,1057,1012],{"class":806},[631,1059,827],{"class":641},[631,1061,1062,1064,1067,1069,1071,1073,1076,1078,1081,1084,1086,1088],{"class":633,"line":865},[631,1063,803],{"class":641},[631,1065,1066],{"class":806},"Cannot",[631,1068,1015],{"class":637},[631,1070,816],{"class":641},[631,1072,819],{"class":641},[631,1074,1075],{"class":822},"admin:access",[631,1077,819],{"class":641},[631,1079,1080],{"class":641},">",[631,1082,1083],{"class":645},"You are not an administrator.",[631,1085,851],{"class":641},[631,1087,1066],{"class":806},[631,1089,827],{"class":641},[593,1091,1092,1094,1095,1098,1099,1102,1103,1105,1106,1109,1110,1112],{},[610,1093,996],{}," renders its default slot when ",[610,1096,1097],{},"can(permission, record)"," is true, else the ",[610,1100,1101],{},"fallback"," slot. ",[610,1104,1000],{}," is the\nopposite. ",[610,1107,1108],{},"permission"," is required; ",[610,1111,1030],{}," is optional.",[615,1114,1116],{"id":1115},"route-rules","Route rules",[593,1118,1119,1120,1128],{},"Rules are keys on Nuxt's native ",[597,1121,1125],{"href":1122,"rel":1123},"https:\u002F\u002Fnuxt.com\u002Fdocs\u002F4.x\u002Fguide\u002Fconcepts\u002Frendering#hybrid-rendering",[1124],"nofollow",[610,1126,1127],{},"routeRules",".\nThere are three:",[622,1130,1133],{"className":624,"code":1131,"filename":1132,"language":626,"meta":627,"style":627},"export default defineNuxtConfig({\n  routeRules: {\n    '\u002Fadmin\u002F**': { permission: 'admin:access' }, \u002F\u002F pages\n    '\u002Fapi\u002Fadmin\u002F**': { permission: 'admin:access' }, \u002F\u002F the staff API of every module\n    '\u002Fadmin\u002Flogin': { authenticated: false }, \u002F\u002F opens a sub-route of a protected pattern\n    '\u002Fmembers\u002F**': { authenticated: true },\n    '\u002Fpricing': { guest: true }, \u002F\u002F signed-out visitors only\n  },\n})\n","nuxt.config.ts",[610,1134,1135,1151,1162,1194,1222,1249,1272,1297,1303],{"__ignoreMap":627},[631,1136,1137,1140,1143,1146,1148],{"class":633,"line":634},[631,1138,1139],{"class":884},"export",[631,1141,1142],{"class":884}," default",[631,1144,1145],{"class":676}," defineNuxtConfig",[631,1147,894],{"class":645},[631,1149,1150],{"class":641},"{\n",[631,1152,1153,1156,1159],{"class":633,"line":830},[631,1154,1155],{"class":806},"  routeRules",[631,1157,1158],{"class":641},":",[631,1160,1161],{"class":641}," {\n",[631,1163,1164,1167,1170,1172,1174,1176,1178,1180,1183,1185,1187,1190],{"class":633,"line":848},[631,1165,1166],{"class":641},"    '",[631,1168,1169],{"class":806},"\u002Fadmin\u002F**",[631,1171,897],{"class":641},[631,1173,1158],{"class":641},[631,1175,642],{"class":641},[631,1177,1015],{"class":806},[631,1179,1158],{"class":641},[631,1181,1182],{"class":641}," '",[631,1184,1075],{"class":822},[631,1186,897],{"class":641},[631,1188,1189],{"class":641}," },",[631,1191,1193],{"class":1192},"sHwdD"," \u002F\u002F pages\n",[631,1195,1196,1198,1201,1203,1205,1207,1209,1211,1213,1215,1217,1219],{"class":633,"line":858},[631,1197,1166],{"class":641},[631,1199,1200],{"class":806},"\u002Fapi\u002Fadmin\u002F**",[631,1202,897],{"class":641},[631,1204,1158],{"class":641},[631,1206,642],{"class":641},[631,1208,1015],{"class":806},[631,1210,1158],{"class":641},[631,1212,1182],{"class":641},[631,1214,1075],{"class":822},[631,1216,897],{"class":641},[631,1218,1189],{"class":641},[631,1220,1221],{"class":1192}," \u002F\u002F the staff API of every module\n",[631,1223,1224,1226,1229,1231,1233,1235,1238,1240,1244,1246],{"class":633,"line":865},[631,1225,1166],{"class":641},[631,1227,1228],{"class":806},"\u002Fadmin\u002Flogin",[631,1230,897],{"class":641},[631,1232,1158],{"class":641},[631,1234,642],{"class":641},[631,1236,1237],{"class":806}," authenticated",[631,1239,1158],{"class":641},[631,1241,1243],{"class":1242},"sfNiH"," false",[631,1245,1189],{"class":641},[631,1247,1248],{"class":1192}," \u002F\u002F opens a sub-route of a protected pattern\n",[631,1250,1251,1253,1256,1258,1260,1262,1264,1266,1269],{"class":633,"line":875},[631,1252,1166],{"class":641},[631,1254,1255],{"class":806},"\u002Fmembers\u002F**",[631,1257,897],{"class":641},[631,1259,1158],{"class":641},[631,1261,642],{"class":641},[631,1263,1237],{"class":806},[631,1265,1158],{"class":641},[631,1267,1268],{"class":1242}," true",[631,1270,1271],{"class":641}," },\n",[631,1273,1274,1276,1279,1281,1283,1285,1288,1290,1292,1294],{"class":633,"line":931},[631,1275,1166],{"class":641},[631,1277,1278],{"class":806},"\u002Fpricing",[631,1280,897],{"class":641},[631,1282,1158],{"class":641},[631,1284,642],{"class":641},[631,1286,1287],{"class":806}," guest",[631,1289,1158],{"class":641},[631,1291,1268],{"class":1242},[631,1293,1189],{"class":641},[631,1295,1296],{"class":1192}," \u002F\u002F signed-out visitors only\n",[631,1298,1300],{"class":633,"line":1299},8,[631,1301,1302],{"class":641},"  },\n",[631,1304,1306,1308],{"class":633,"line":1305},9,[631,1307,670],{"class":641},[631,1309,1310],{"class":645},")\n",[682,1312,1313,1323],{},[685,1314,1315],{},[688,1316,1317,1320],{},[691,1318,1319],{},"Key",[691,1321,1322],{},"Meaning",[698,1324,1325,1339,1360],{},[688,1326,1327,1331],{},[703,1328,1329],{},[610,1330,1108],{},[703,1332,1333,1334,774,1336,1338],{},"A registered permission the user must hold. ",[610,1335,773],{},[610,1337,777],{}," without it. An unknown permission fails the build.",[688,1340,1341,1346],{},[703,1342,1343],{},[610,1344,1345],{},"authenticated",[703,1347,1348,1351,1352,1355,1356,1359],{},[610,1349,1350],{},"true"," requires a ",[597,1353,1354],{"href":87},"signed-in user",". ",[610,1357,1358],{},"false"," turns the rules of less specific patterns off for the path.",[688,1361,1362,1367],{},[703,1363,1364],{},[610,1365,1366],{},"guest",[703,1368,1369,1370,604],{},"Only for signed-out visitors. A signed-in user gets ",[610,1371,777],{},[939,1373,1374,1384,1394,1405,1419,1437,1447],{},[942,1375,1376,1377,1379,1380,1383],{},"Patterns follow route rules: a ",[610,1378,1169],{}," prefix, ",[610,1381,1382],{},"*"," for one segment, or an exact path. Every matching pattern\ncontributes, and keys of more specific patterns win.",[942,1385,1386,1389,1390,1393],{},[732,1387,1388],{},"Who enforces them."," Auth's server middleware enforces the rules for ",[610,1391,1392],{},"\u002Fapi\u002F**",", so they fail closed even without\nAuthorization. Authorization adds the page middleware, which also runs during server-side rendering. A tampered client\ncan still reach the API only as far as the API allows.",[942,1395,1396,1397,1400,1401,1404],{},"The server middleware runs ",[610,1398,1399],{},"authorize",", so tokens, ",[610,1402,1403],{},"sessionOnly"," permissions and the before hook apply there exactly as\nin a handler. A rule is coarse: the handler still authorizes its own permission and records.",[942,1406,1407,1408,1411,1412,1415,1416,604],{},"The middleware matches the percent-decoded path the router dispatches on, and an API path with an encoded ",[610,1409,1410],{},"\u002F",", a ",[610,1413,1414],{},"\\","\nor a dot segment is refused with ",[610,1417,1418],{},"400",[942,1420,1421,1427,1428,905,1431,1434,1435,604],{},[732,1422,1423,1424,1426],{},"Only pages and ",[610,1425,1392],{}," are enforced."," A rule for another server route (",[610,1429,1430],{},"\u002Fmcp",[610,1432,1433],{},"\u002Foauth\u002F**",") matches no page and is\nnot enforced: the build warns about it. Guard such routes in their handler with ",[610,1436,1399],{},[942,1438,1439,1440,1442,1443,1446],{},"Nuxt's app-side route rules matcher keeps only a fixed set of keys, so the module collects these keys from ",[610,1441,1127],{},"\nand ",[610,1444,1445],{},"nitro.routeRules"," at build time. Rules added at runtime are not picked up.",[942,1448,1449,1450,905,1453,997,1456,1459,1460,604],{},"Rules named ",[610,1451,1452],{},"roles",[610,1454,1455],{},"ability",[610,1457,1458],{},"scopes"," are not rules of this release. See\n",[597,1461,1462],{"href":152},"Migrate access control",[1464,1465,1467],"h3",{"id":1466},"sign-in-paths","Sign-in paths",[593,1469,1470,1471,1474,1475,1478,1479,1483],{},"Auth's anonymous entry points are always reachable, so ",[610,1472,1473],{},"'\u002F**': { authenticated: true }"," does not lock users out of\nsigning in. They come from ",[610,1476,1477],{},"runtimeConfig.public.authentication.publicPaths","\n(",[597,1480,1482],{"href":1481},"\u002Fmodules\u002Fidentity\u002Fauth\u002Freference#anonymous-paths","Auth reference",").",[939,1485,1486,1493,1500],{},[942,1487,1488,1489,1492],{},"An exempt pattern resets the rule: guards of ",[732,1490,1491],{},"less specific"," patterns stop there.",[942,1494,1495,1496,1499],{},"A rule for the ",[732,1497,1498],{},"same or a more specific"," pattern still applies.",[942,1501,1502,1503,1506,1507,1510],{},"With ",[610,1504,1505],{},"@nuxtjs\u002Fi18n"," the page patterns are exempt under every locale prefix too (",[610,1508,1509],{},"\u002Fda\u002Flogin","). API paths are not\nprefixed.",[615,1512,1514],{"id":1513},"page-meta","Page meta",[593,1516,1517,1520,1521,1524],{},[610,1518,1519],{},"definePageMeta({ authorize })"," ",[732,1522,1523],{},"replaces"," the matching route rules for one page:",[622,1526,1528],{"className":794,"code":1527,"language":796,"meta":627,"style":627},"\u003Cscript setup lang=\"ts\">\ndefinePageMeta({ authorize: 'events:update' })\n\u002F\u002F or a rule: { permission: 'events:update' } | { authenticated: true } | { guest: true }\n\u003C\u002Fscript>\n",[610,1529,1530,1550,1575,1580],{"__ignoreMap":627},[631,1531,1532,1534,1536,1538,1540,1542,1544,1546,1548],{"class":633,"line":634},[631,1533,803],{"class":641},[631,1535,807],{"class":806},[631,1537,810],{"class":637},[631,1539,813],{"class":637},[631,1541,816],{"class":641},[631,1543,819],{"class":641},[631,1545,626],{"class":822},[631,1547,819],{"class":641},[631,1549,827],{"class":641},[631,1551,1552,1555,1557,1560,1562,1564,1566,1568,1570,1573],{"class":633,"line":830},[631,1553,1554],{"class":676},"definePageMeta",[631,1556,894],{"class":645},[631,1558,1559],{"class":641},"{",[631,1561,662],{"class":806},[631,1563,1158],{"class":641},[631,1565,1182],{"class":641},[631,1567,1022],{"class":822},[631,1569,897],{"class":641},[631,1571,1572],{"class":641}," }",[631,1574,1310],{"class":645},[631,1576,1577],{"class":633,"line":848},[631,1578,1579],{"class":1192},"\u002F\u002F or a rule: { permission: 'events:update' } | { authenticated: true } | { guest: true }\n",[631,1581,1582,1584,1586],{"class":633,"line":858},[631,1583,851],{"class":641},[631,1585,807],{"class":806},[631,1587,827],{"class":641},[593,1589,1590,1593],{},[610,1591,1592],{},"definePageMeta({ authorize: false })"," opens the page, whatever the route rules say. A page that names an unregistered\npermission fails the build (checked when pages resolve).",[622,1595,1597],{"className":624,"code":1596,"language":626,"meta":627,"style":627},"interface RouteRule {\n  permission?: string\n  authenticated?: boolean\n  guest?: boolean\n}\ntype AuthorizeMeta = string | RouteRule | false\n",[610,1598,1599,1610,1621,1631,1640,1645],{"__ignoreMap":627},[631,1600,1601,1604,1608],{"class":633,"line":634},[631,1602,1603],{"class":637},"interface",[631,1605,1607],{"class":1606},"sBMFI"," RouteRule",[631,1609,1161],{"class":641},[631,1611,1612,1615,1618],{"class":633,"line":830},[631,1613,1614],{"class":806},"  permission",[631,1616,1617],{"class":641},"?:",[631,1619,1620],{"class":1606}," string\n",[631,1622,1623,1626,1628],{"class":633,"line":848},[631,1624,1625],{"class":806},"  authenticated",[631,1627,1617],{"class":641},[631,1629,1630],{"class":1606}," boolean\n",[631,1632,1633,1636,1638],{"class":633,"line":858},[631,1634,1635],{"class":806},"  guest",[631,1637,1617],{"class":641},[631,1639,1630],{"class":1606},[631,1641,1642],{"class":633,"line":865},[631,1643,1644],{"class":641},"}\n",[631,1646,1647,1650,1653,1655,1658,1661,1663,1665],{"class":633,"line":875},[631,1648,1649],{"class":637},"type",[631,1651,1652],{"class":1606}," AuthorizeMeta",[631,1654,673],{"class":641},[631,1656,1657],{"class":1606}," string",[631,1659,1660],{"class":641}," |",[631,1662,1607],{"class":1606},[631,1664,1660],{"class":641},[631,1666,1667],{"class":1606}," false\n",[593,1669,1670,1671,1673,1674,1676,1677,1680,1681,1684,1685,1687,1688,1690,1691,604],{},"A visitor who fails a ",[610,1672,1108],{}," or ",[610,1675,1345],{}," rule is sent to ",[610,1678,1679],{},"redirectTo"," with the page in ",[610,1682,1683],{},"?redirect=","; with\nno ",[610,1686,1679],{},", they see a ",[610,1689,773],{}," error. A signed-in user without the permission sees ",[610,1692,777],{},[615,1694,1696],{"id":1695},"menus-tabs-and-widgets","Menus, tabs and widgets",[593,1698,1699,1700,1702,1703,1705,1706,1708,1709,905,1712,997,1715,1718],{},"Menu items (",[597,1701,354],{"href":355},"), widgets and tabs (",[597,1704,358],{"href":359},") and account menu\nitems take a ",[610,1707,1108],{},". Authorization hides the ones the viewer does not hold, children included, through the\n",[610,1710,1711],{},"menus:filter",[610,1713,1714],{},"widgets:filter",[610,1716,1717],{},"tabs:filter"," hooks. The menu cache key includes an access version, so menus filter\nagain on sign-in and sign-out.",[622,1720,1722],{"className":624,"code":1721,"language":626,"meta":627,"style":627},"{ label: 'Reports', to: '\u002Fadmin\u002Freports', permission: 'reports:read' }\n",[610,1723,1724],{"__ignoreMap":627},[631,1725,1726,1728,1730,1732,1734,1737,1739,1741,1744,1746,1748,1751,1753,1755,1757,1759,1761,1764,1766],{"class":633,"line":634},[631,1727,1559],{"class":641},[631,1729,916],{"class":1606},[631,1731,1158],{"class":641},[631,1733,1182],{"class":641},[631,1735,1736],{"class":822},"Reports",[631,1738,897],{"class":641},[631,1740,649],{"class":641},[631,1742,1743],{"class":1606}," to",[631,1745,1158],{"class":641},[631,1747,1182],{"class":641},[631,1749,1750],{"class":822},"\u002Fadmin\u002Freports",[631,1752,897],{"class":641},[631,1754,649],{"class":641},[631,1756,1015],{"class":1606},[631,1758,1158],{"class":641},[631,1760,1182],{"class":641},[631,1762,1763],{"class":822},"reports:read",[631,1765,897],{"class":641},[631,1767,1768],{"class":641}," }\n",[593,1770,1771],{},"It only hides what is shown. The route behind an item, and the data behind a widget or tab, still check the permission\nthemselves.",[615,1773,183],{"id":1774},"client-mode",[593,1776,1502,1777,1780,1781,1784,1785,1788,1789,1791],{},[610,1778,1779],{},"authentication.mode: 'client'"," (see ",[597,1782,1783],{"href":184},"Auth client mode","), the module runs in\nthe app only. This is how ",[610,1786,1787],{},"@frigear-nu\u002Fmobile"," apps and any single-page app against an\n",[597,1790,225],{"href":226}," issuer work.",[939,1793,1794,1805,1808,1829,1836,1839],{},[942,1795,1796,1797,905,1800,997,1802,1804],{},"The route middleware, ",[610,1798,1799],{},"useAuthorization",[610,1801,996],{},[610,1803,1000],{}," work as in server mode.",[942,1806,1807],{},"There is no server side: no tables, no role assignment, no roles admin.",[942,1809,1810,1520,1813,1815,1816,1818,1819,1822,1823,1825,1826,1828],{},[732,1811,1812],{},"Where access comes from.",[610,1814,620],{}," calls the issuer's ",[610,1817,716],{}," with the bearer access\ntoken. When the issuer has no such endpoint (a ",[610,1820,1821],{},"404",", or offline, for example the external frigear.nu), it falls back\nto the access token's frozen ",[610,1824,981],{}," claim, decoded without verification. ",[610,1827,1452],{}," is only present when the\nissuer answers.",[942,1830,1831,1832,1835],{},"The user is the ID token's claims mapping. Roles are not read from the token, so a ",[610,1833,1834],{},"role"," claim has no effect.",[942,1837,1838],{},"Shared policies work the same, because the file is framework free: import it in the app as on the server.",[942,1840,1841,1842,1844],{},"A guest redirects to ",[610,1843,1679],{},", which defaults to Auth's sign-in path.",[1846,1847,1848,1849,604],"caution",{},"In client mode the guards shape the interface; they are not access control. The ID token and stored tokens live where\nthe device owner can edit them. See ",[597,1850,1852],{"href":1851},"\u002Fmodules\u002Fidentity\u002Fauth\u002Fclient-mode#security","Security",[593,1854,1855,1857,1858,1861],{},[597,1856,362],{"href":363}," apps use exactly this: ",[610,1859,1860],{},"can('tickets:read')"," decides which tabs to show, and the\nAPI the app calls enforces it.",[615,1863,1865],{"id":1864},"next-steps","Next steps",[939,1867,1868,1875,1880],{},[942,1869,1870,1872,1873,604],{},[597,1871,209],{"href":210}," – shared policies behind ",[610,1874,1097],{},[942,1876,1877,1879],{},[597,1878,217],{"href":218}," – the roles pages.",[942,1881,1882,997,1884,1886,1887,1889],{},[597,1883,354],{"href":355},[597,1885,358],{"href":359}," – the ",[610,1888,1108],{}," field.",[1891,1892,1893],"style",{},"html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}",{"title":627,"searchDepth":830,"depth":830,"links":1895},[1896,1897,1899,1902,1903,1904,1905],{"id":617,"depth":830,"text":620},{"id":993,"depth":830,"text":1898},"\u003CCan> and \u003CCannot>",{"id":1115,"depth":830,"text":1116,"children":1900},[1901],{"id":1466,"depth":848,"text":1467},{"id":1513,"depth":830,"text":1514},{"id":1695,"depth":830,"text":1696},{"id":1774,"depth":830,"text":183},{"id":1864,"depth":830,"text":1865},"useAuthorization(), Can and Cannot, route rules, page meta and filtered menus, plus access in client mode and mobile apps.","md",null,{},{"title":213},{"title":213,"description":1906},"qbYCciSOM3QC7Vki3q8MhuQv1-5QqR3Wz427LlDvNPs",[1914,1916],{"title":209,"path":210,"stem":211,"description":1915,"children":-1},"Refine one permission against a record, such as \"only the author may edit\", on the server and in the interface.",{"title":217,"path":218,"stem":219,"description":1917,"children":-1},"The roles pages and the Roles and permissions tab on the user page, where staff see why a role holds a permission and assign roles.",1794503155309]