[{"data":1,"prerenderedAt":1763},["ShallowReactive",2],{"navigation_docs":3,"-modules-identity-authorization-policies":587,"-modules-identity-authorization-policies-surround":1758},[4,50,155,441,504],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":49},"Get Started","i-lucide-rocket","\u002Fget-started","1.get-started",[10,15,20,25,30,35,40,45],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fget-started\u002Fintroduction","1.get-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Installation","\u002Fget-started\u002Finstallation","1.get-started\u002F2.installation","i-lucide-download",{"title":21,"path":22,"stem":23,"icon":24},"Project structure","\u002Fget-started\u002Fproject-structure","1.get-started\u002F3.project-structure","i-lucide-folder-tree",{"title":26,"path":27,"stem":28,"icon":29},"Configuration","\u002Fget-started\u002Fconfiguration","1.get-started\u002F4.configuration","i-lucide-settings",{"title":31,"path":32,"stem":33,"icon":34},"Authentication","\u002Fget-started\u002Fauthentication","1.get-started\u002F5.authentication","i-lucide-lock",{"title":36,"path":37,"stem":38,"icon":39},"Adding modules","\u002Fget-started\u002Fadding-modules","1.get-started\u002F6.adding-modules","i-lucide-puzzle",{"title":41,"path":42,"stem":43,"icon":44},"Database","\u002Fget-started\u002Fdatabase","1.get-started\u002F7.database","i-lucide-database",{"title":46,"path":47,"stem":48,"icon":6},"Deployment","\u002Fget-started\u002Fdeployment","1.get-started\u002F8.deployment",false,{"title":51,"icon":52,"path":53,"stem":54,"children":55,"page":49},"Guide","i-lucide-book-open","\u002Fguide","2.guide",[56,90,115,125],{"title":57,"icon":49,"path":58,"stem":59,"children":60,"page":49},"Concepts","\u002Fguide\u002Fconcepts","2.guide\u002F1.concepts",[61,66,71,76,80,85],{"title":62,"path":63,"stem":64,"icon":65},"Architecture","\u002Fguide\u002Fconcepts\u002Farchitecture","2.guide\u002F1.concepts\u002F1.architecture","i-lucide-blocks",{"title":67,"path":68,"stem":69,"icon":70},"Access control","\u002Fguide\u002Fconcepts\u002Fauth-and-scopes","2.guide\u002F1.concepts\u002F2.auth-and-scopes","i-lucide-shield-check",{"title":72,"path":73,"stem":74,"icon":75},"Extension points","\u002Fguide\u002Fconcepts\u002Fextension-points","2.guide\u002F1.concepts\u002F3.extension-points","i-lucide-plug",{"title":77,"path":78,"stem":79,"icon":44},"Database extensions","\u002Fguide\u002Fconcepts\u002Fdatabase-extensions","2.guide\u002F1.concepts\u002F4.database-extensions",{"title":81,"path":82,"stem":83,"icon":84},"Identity","\u002Fguide\u002Fconcepts\u002Fidentity","2.guide\u002F1.concepts\u002F5.identity","i-lucide-fingerprint",{"title":86,"path":87,"stem":88,"icon":89},"Glossary","\u002Fguide\u002Fconcepts\u002Fglossary","2.guide\u002F1.concepts\u002F6.glossary","i-lucide-book-a",{"title":91,"icon":49,"path":92,"stem":93,"children":94,"page":49},"UX patterns","\u002Fguide\u002Fux-patterns","2.guide\u002F2.ux-patterns",[95,100,105,110],{"title":96,"path":97,"stem":98,"icon":99},"Layouts and navigation","\u002Fguide\u002Fux-patterns\u002Flayouts-and-navigation","2.guide\u002F2.ux-patterns\u002F1.layouts-and-navigation","i-lucide-layout-template",{"title":101,"path":102,"stem":103,"icon":104},"Pages","\u002Fguide\u002Fux-patterns\u002Fpages","2.guide\u002F2.ux-patterns\u002F2.pages","i-lucide-table",{"title":106,"path":107,"stem":108,"icon":109},"Forms and actions","\u002Fguide\u002Fux-patterns\u002Fforms-and-actions","2.guide\u002F2.ux-patterns\u002F3.forms-and-actions","i-lucide-square-pen",{"title":111,"path":112,"stem":113,"icon":114},"Text and formatting","\u002Fguide\u002Fux-patterns\u002Ftext-and-formatting","2.guide\u002F2.ux-patterns\u002F4.text-and-formatting","i-lucide-type",{"title":116,"icon":49,"path":117,"stem":118,"children":119,"page":49},"Best practices","\u002Fguide\u002Fbest-practices","2.guide\u002F3.best-practices",[120],{"title":121,"path":122,"stem":123,"icon":124},"HTTP routes","\u002Fguide\u002Fbest-practices\u002Fhttp-routes","2.guide\u002F3.best-practices\u002F1.http-routes","i-lucide-route",{"title":126,"icon":49,"path":127,"stem":128,"children":129,"page":49},"Going further","\u002Fguide\u002Fgoing-further","2.guide\u002F4.going-further",[130,135,140,145,150],{"title":131,"path":132,"stem":133,"icon":134},"Use your own OAuth server","\u002Fguide\u002Fgoing-further\u002Fown-oauth-server","2.guide\u002F4.going-further\u002F1.own-oauth-server","i-lucide-key-round",{"title":136,"path":137,"stem":138,"icon":139},"Create an OAuth application","\u002Fguide\u002Fgoing-further\u002Foauth-application","2.guide\u002F4.going-further\u002F2.oauth-application","i-lucide-app-window",{"title":141,"path":142,"stem":143,"icon":144},"Signing keys","\u002Fguide\u002Fgoing-further\u002Fsigning-keys","2.guide\u002F4.going-further\u002F3.signing-keys","i-lucide-key-square",{"title":146,"path":147,"stem":148,"icon":149},"Stripe setup","\u002Fguide\u002Fgoing-further\u002Fstripe-setup","2.guide\u002F4.going-further\u002F4.stripe-setup","i-lucide-credit-card",{"title":151,"path":152,"stem":153,"icon":154},"Migrate to the permission model","\u002Fguide\u002Fgoing-further\u002Fmigrate-access-control","2.guide\u002F4.going-further\u002F5.migrate-access-control","i-lucide-arrow-right-left",{"title":156,"icon":157,"path":158,"stem":159,"children":160},"Modules","i-lucide-boxes","\u002Fmodules","3.modules",[161,163,244,273,320,375],{"title":156,"path":158,"stem":162},"3.modules\u002Findex",{"title":81,"icon":49,"path":164,"stem":165,"children":166,"page":49},"\u002Fmodules\u002Fidentity","3.modules\u002F1.identity",[167,190,194,198,220,224,240],{"title":168,"path":169,"stem":170,"children":171},"Auth","\u002Fmodules\u002Fidentity\u002Fauth","3.modules\u002F1.identity\u002F1.auth\u002Findex",[172,174,178,182,186],{"title":173,"path":169,"stem":170},"Overview",{"title":175,"path":176,"stem":177},"Server API","\u002Fmodules\u002Fidentity\u002Fauth\u002Fserver","3.modules\u002F1.identity\u002F1.auth\u002F2.server",{"title":179,"path":180,"stem":181},"Reference","\u002Fmodules\u002Fidentity\u002Fauth\u002Freference","3.modules\u002F1.identity\u002F1.auth\u002F3.reference",{"title":183,"path":184,"stem":185},"Client mode","\u002Fmodules\u002Fidentity\u002Fauth\u002Fclient-mode","3.modules\u002F1.identity\u002F1.auth\u002F4.client-mode",{"title":187,"path":188,"stem":189},"OAuth providers","\u002Fmodules\u002Fidentity\u002Fauth\u002Foauth-providers","3.modules\u002F1.identity\u002F1.auth\u002F5.oauth-providers",{"title":191,"path":192,"stem":193},"Users","\u002Fmodules\u002Fidentity\u002Fusers","3.modules\u002F1.identity\u002F2.users",{"title":195,"path":196,"stem":197},"Account","\u002Fmodules\u002Fidentity\u002Faccount","3.modules\u002F1.identity\u002F3.account",{"title":199,"path":200,"stem":201,"children":202},"Authorization","\u002Fmodules\u002Fidentity\u002Fauthorization","3.modules\u002F1.identity\u002F4.authorization\u002Findex",[203,204,208,212,216],{"title":173,"path":200,"stem":201},{"title":205,"path":206,"stem":207},"Roles and requirements","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Froles-and-requirements","3.modules\u002F1.identity\u002F4.authorization\u002F2.roles-and-requirements",{"title":209,"path":210,"stem":211},"Policies","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fpolicies","3.modules\u002F1.identity\u002F4.authorization\u002F3.policies",{"title":213,"path":214,"stem":215},"Client","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fclient","3.modules\u002F1.identity\u002F4.authorization\u002F4.client",{"title":217,"path":218,"stem":219},"Admin","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fadmin","3.modules\u002F1.identity\u002F4.authorization\u002F5.admin",{"title":221,"path":222,"stem":223},"Preferences","\u002Fmodules\u002Fidentity\u002Fpreferences","3.modules\u002F1.identity\u002F5.preferences",{"title":225,"path":226,"stem":227,"children":228},"OAuth Server","\u002Fmodules\u002Fidentity\u002Foauth-server","3.modules\u002F1.identity\u002F6.oauth-server\u002Findex",[229,230,233,237],{"title":173,"path":226,"stem":227},{"title":175,"path":231,"stem":232},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fserver","3.modules\u002F1.identity\u002F6.oauth-server\u002F2.server",{"title":234,"path":235,"stem":236},"Hooks","\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fhooks","3.modules\u002F1.identity\u002F6.oauth-server\u002F3.hooks",{"title":179,"path":238,"stem":239},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Froutes-and-clients","3.modules\u002F1.identity\u002F6.oauth-server\u002F4.routes-and-clients",{"title":241,"path":242,"stem":243},"OAuth Resource","\u002Fmodules\u002Fidentity\u002Foauth-resource","3.modules\u002F1.identity\u002F8.oauth-resource",{"title":245,"icon":49,"path":246,"stem":247,"children":248,"page":49},"Commerce","\u002Fmodules\u002Fcommerce","3.modules\u002F2.commerce",[249,253,257],{"title":250,"path":251,"stem":252},"Stripe","\u002Fmodules\u002Fcommerce\u002Fstripe","3.modules\u002F2.commerce\u002F1.stripe",{"title":254,"path":255,"stem":256},"Payments","\u002Fmodules\u002Fcommerce\u002Fpayments","3.modules\u002F2.commerce\u002F2.payments",{"title":258,"path":259,"stem":260,"children":261},"Subscriptions","\u002Fmodules\u002Fcommerce\u002Fsubscriptions","3.modules\u002F2.commerce\u002F3.subscriptions\u002Findex",[262,263,266,270],{"title":173,"path":259,"stem":260},{"title":175,"path":264,"stem":265},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fserver","3.modules\u002F2.commerce\u002F3.subscriptions\u002F2.server",{"title":267,"path":268,"stem":269},"App","\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fapp","3.modules\u002F2.commerce\u002F3.subscriptions\u002F3.app",{"title":179,"path":271,"stem":272},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Freference","3.modules\u002F2.commerce\u002F3.subscriptions\u002F4.reference",{"title":274,"icon":49,"path":275,"stem":276,"children":277,"page":49},"Features","\u002Fmodules\u002Ffeatures","3.modules\u002F3.features",[278,293,312,316],{"title":279,"path":280,"stem":281,"children":282},"Events","\u002Fmodules\u002Ffeatures\u002Fevents","3.modules\u002F3.features\u002F1.events\u002Findex",[283,284,287,290],{"title":173,"path":280,"stem":281},{"title":175,"path":285,"stem":286},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fserver","3.modules\u002F3.features\u002F1.events\u002F2.server",{"title":267,"path":288,"stem":289},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fapp","3.modules\u002F3.features\u002F1.events\u002F3.app",{"title":179,"path":291,"stem":292},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Freference","3.modules\u002F3.features\u002F1.events\u002F4.reference",{"title":294,"path":295,"stem":296,"children":297},"Forms","\u002Fmodules\u002Ffeatures\u002Fforms","3.modules\u002F3.features\u002F2.forms\u002Findex",[298,299,303,306,309],{"title":173,"path":295,"stem":296},{"title":300,"path":301,"stem":302},"Definition","\u002Fmodules\u002Ffeatures\u002Fforms\u002Fdefinition","3.modules\u002F3.features\u002F2.forms\u002F2.definition",{"title":175,"path":304,"stem":305},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fserver","3.modules\u002F3.features\u002F2.forms\u002F3.server",{"title":267,"path":307,"stem":308},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fapp","3.modules\u002F3.features\u002F2.forms\u002F4.app",{"title":179,"path":310,"stem":311},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Freference","3.modules\u002F3.features\u002F2.forms\u002F5.reference",{"title":313,"path":314,"stem":315},"Cookie Consent","\u002Fmodules\u002Ffeatures\u002Fcookie-consent","3.modules\u002F3.features\u002F3.cookie-consent",{"title":317,"path":318,"stem":319},"MCP","\u002Fmodules\u002Ffeatures\u002Fmcp","3.modules\u002F3.features\u002F4.mcp",{"title":321,"icon":49,"path":322,"stem":323,"children":324,"page":49},"Interface","\u002Fmodules\u002Finterface","3.modules\u002F4.interface",[325,350,353,357,361],{"title":326,"path":327,"stem":328,"children":329},"UI","\u002Fmodules\u002Finterface\u002Fui","3.modules\u002F4.interface\u002F1.ui\u002Findex",[330,331,335,339,343,347],{"title":173,"path":327,"stem":328},{"title":332,"path":333,"stem":334},"Page components","\u002Fmodules\u002Finterface\u002Fui\u002Fpage-components","3.modules\u002F4.interface\u002F1.ui\u002F2.page-components",{"title":336,"path":337,"stem":338},"App shell","\u002Fmodules\u002Finterface\u002Fui\u002Fapp-shell","3.modules\u002F4.interface\u002F1.ui\u002F3.app-shell",{"title":340,"path":341,"stem":342},"Form inputs","\u002Fmodules\u002Finterface\u002Fui\u002Fform-inputs","3.modules\u002F4.interface\u002F1.ui\u002F4.form-inputs",{"title":344,"path":345,"stem":346},"Composables and helpers","\u002Fmodules\u002Finterface\u002Fui\u002Fcomposables","3.modules\u002F4.interface\u002F1.ui\u002F5.composables",{"title":179,"path":348,"stem":349},"\u002Fmodules\u002Finterface\u002Fui\u002Freference","3.modules\u002F4.interface\u002F1.ui\u002F6.reference",{"title":217,"path":351,"stem":352},"\u002Fmodules\u002Finterface\u002Fadmin","3.modules\u002F4.interface\u002F2.admin",{"title":354,"path":355,"stem":356},"Menu","\u002Fmodules\u002Finterface\u002Fmenu","3.modules\u002F4.interface\u002F3.menu",{"title":358,"path":359,"stem":360},"Widget","\u002Fmodules\u002Finterface\u002Fwidget","3.modules\u002F4.interface\u002F4.widget",{"title":362,"path":363,"stem":364,"children":365},"Mobile","\u002Fmodules\u002Finterface\u002Fmobile","3.modules\u002F4.interface\u002F5.mobile\u002Findex",[366,367,371],{"title":173,"path":363,"stem":364},{"title":368,"path":369,"stem":370},"CLI and devices","\u002Fmodules\u002Finterface\u002Fmobile\u002Fcli-and-devices","3.modules\u002F4.interface\u002F5.mobile\u002F2.cli-and-devices",{"title":372,"path":373,"stem":374},"Splash screen","\u002Fmodules\u002Finterface\u002Fmobile\u002Fsplash-screen","3.modules\u002F4.interface\u002F5.mobile\u002F3.splash-screen",{"title":376,"icon":49,"path":377,"stem":378,"children":379,"page":49},"Platform","\u002Fmodules\u002Fplatform","3.modules\u002F5.platform",[380,402,406,423],{"title":381,"path":382,"stem":383,"children":384},"Module Kit","\u002Fmodules\u002Fplatform\u002Fmodule-kit","3.modules\u002F5.platform\u002F1.module-kit\u002Findex",[385,386,390,394,398],{"title":173,"path":382,"stem":383},{"title":387,"path":388,"stem":389},"Server toolkit","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fserver-toolkit","3.modules\u002F5.platform\u002F1.module-kit\u002F2.server-toolkit",{"title":391,"path":392,"stem":393},"Registries and menus","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fregistries-and-menus","3.modules\u002F5.platform\u002F1.module-kit\u002F3.registries-and-menus",{"title":395,"path":396,"stem":397},"Translations","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fi18n","3.modules\u002F5.platform\u002F1.module-kit\u002F4.i18n",{"title":399,"path":400,"stem":401},"Database helpers","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fdatabase","3.modules\u002F5.platform\u002F1.module-kit\u002F5.database",{"title":403,"path":404,"stem":405},"Notify","\u002Fmodules\u002Fplatform\u002Fnotify","3.modules\u002F5.platform\u002F2.notify",{"title":407,"path":408,"stem":409,"children":410},"Email Templates","\u002Fmodules\u002Fplatform\u002Femail-templates","3.modules\u002F5.platform\u002F3.email-templates\u002Findex",[411,412,416,419],{"title":173,"path":408,"stem":409},{"title":413,"path":414,"stem":415},"Email components","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fcomponents","3.modules\u002F5.platform\u002F3.email-templates\u002F2.components",{"title":175,"path":417,"stem":418},"\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fserver","3.modules\u002F5.platform\u002F3.email-templates\u002F3.server",{"title":420,"path":421,"stem":422},"Module emails","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fmodule-emails","3.modules\u002F5.platform\u002F3.email-templates\u002F4.module-emails",{"title":424,"path":425,"stem":426,"children":427},"Base Layer","\u002Fmodules\u002Fplatform\u002Fbase-layer","3.modules\u002F5.platform\u002F4.base-layer\u002Findex",[428,429,433,437],{"title":173,"path":425,"stem":426},{"title":430,"path":431,"stem":432},"Content collections","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcontent-collections","3.modules\u002F5.platform\u002F4.base-layer\u002F2.content-collections",{"title":434,"path":435,"stem":436},"Layouts and routing","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Flayouts-and-routing","3.modules\u002F5.platform\u002F4.base-layer\u002F3.layouts-and-routing",{"title":438,"path":439,"stem":440},"Composables and utils","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcomposables-and-utils","3.modules\u002F5.platform\u002F4.base-layer\u002F4.composables-and-utils",{"title":442,"icon":443,"path":444,"stem":445,"children":446,"page":49},"Examples","i-lucide-code-xml","\u002Fexamples","4.examples",[447,466,476],{"title":448,"icon":49,"path":449,"stem":450,"children":451,"page":49},"Starters","\u002Fexamples\u002Fstarters","4.examples\u002F1.starters",[452,456,461],{"title":453,"path":454,"stem":455,"icon":6},"Workspace starter","\u002Fexamples\u002Fstarters\u002Fworkspace","4.examples\u002F1.starters\u002F1.workspace",{"title":457,"path":458,"stem":459,"icon":460},"Mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile","4.examples\u002F1.starters\u002F2.mobile","i-lucide-smartphone",{"title":462,"path":463,"stem":464,"icon":465},"Standalone mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile-standalone","4.examples\u002F1.starters\u002F3.mobile-standalone","i-lucide-tablet-smartphone",{"title":467,"icon":49,"path":468,"stem":469,"children":470,"page":49},"Apps","\u002Fexamples\u002Fapps","4.examples\u002F2.apps",[471],{"title":472,"path":473,"stem":474,"icon":475},"Frigear website app","\u002Fexamples\u002Fapps\u002Ffrigear-nu-website","4.examples\u002F2.apps\u002F1.frigear-nu-website","i-lucide-layout-dashboard",{"title":477,"icon":49,"path":478,"stem":479,"children":480,"page":49},"Tasks","\u002Fexamples\u002Ftasks","4.examples\u002F3.tasks",[481,485,489,494,499],{"title":482,"path":483,"stem":484,"icon":70},"Protect a route","\u002Fexamples\u002Ftasks\u002Fprotect-a-route","4.examples\u002F3.tasks\u002F1.protect-a-route",{"title":486,"path":487,"stem":488,"icon":475},"Add an admin page","\u002Fexamples\u002Ftasks\u002Fadd-an-admin-page","4.examples\u002F3.tasks\u002F2.add-an-admin-page",{"title":490,"path":491,"stem":492,"icon":493},"Sell event tickets","\u002Fexamples\u002Ftasks\u002Fsell-event-tickets","4.examples\u002F3.tasks\u002F3.sell-event-tickets","i-lucide-ticket",{"title":495,"path":496,"stem":497,"icon":498},"Build a form","\u002Fexamples\u002Ftasks\u002Fbuild-a-form","4.examples\u002F3.tasks\u002F4.build-a-form","i-lucide-clipboard-list",{"title":500,"path":501,"stem":502,"icon":503},"Send an email","\u002Fexamples\u002Ftasks\u002Fsend-an-email","4.examples\u002F3.tasks\u002F5.send-an-email","i-lucide-mail",{"title":505,"icon":506,"path":507,"stem":508,"children":509,"page":49},"Contribute","i-lucide-git-pull-request","\u002Fcontribute","5.contribute",[510,513,518,544,549,552,556,571],{"title":173,"path":511,"stem":512,"icon":506},"\u002Fcontribute\u002Foverview","5.contribute\u002F1.overview",{"title":514,"path":515,"stem":516,"icon":517},"Local development","\u002Fcontribute\u002Flocal-development","5.contribute\u002F2.local-development","i-lucide-terminal",{"title":519,"icon":49,"path":520,"stem":521,"children":522,"page":49},"Writing a module","\u002Fcontribute\u002Fwriting-a-module","5.contribute\u002F3.writing-a-module",[523,527,532,536,541],{"title":524,"path":525,"stem":526,"icon":39},"Scaffold a module","\u002Fcontribute\u002Fwriting-a-module\u002Fscaffold","5.contribute\u002F3.writing-a-module\u002F1.scaffold",{"title":528,"path":529,"stem":530,"icon":531},"Setup checklist","\u002Fcontribute\u002Fwriting-a-module\u002Fsetup-checklist","5.contribute\u002F3.writing-a-module\u002F2.setup-checklist","i-lucide-list-checks",{"title":533,"path":534,"stem":535,"icon":44},"Database tables","\u002Fcontribute\u002Fwriting-a-module\u002Fdatabase-tables","5.contribute\u002F3.writing-a-module\u002F3.database-tables",{"title":537,"path":538,"stem":539,"icon":540},"Testing","\u002Fcontribute\u002Fwriting-a-module\u002Ftesting","5.contribute\u002F3.writing-a-module\u002F4.testing","i-lucide-flask-conical",{"title":67,"path":542,"stem":543,"icon":70},"\u002Fcontribute\u002Fwriting-a-module\u002Faccess-control","5.contribute\u002F3.writing-a-module\u002F5.access-control",{"title":545,"path":546,"stem":547,"icon":548},"Publishing","\u002Fcontribute\u002Fpublishing","5.contribute\u002F4.publishing","i-lucide-package-check",{"title":448,"path":550,"stem":551,"icon":6},"\u002Fcontribute\u002Fstarters","5.contribute\u002F5.starters",{"title":553,"path":554,"stem":555,"icon":52},"Documentation","\u002Fcontribute\u002Fdocumentation","5.contribute\u002F6.documentation",{"title":557,"icon":49,"path":558,"stem":559,"children":560,"page":49},"Tooling","\u002Fcontribute\u002Ftooling","5.contribute\u002F7.tooling",[561,566],{"title":562,"path":563,"stem":564,"icon":565},"CLI","\u002Fcontribute\u002Ftooling\u002Fcli","5.contribute\u002F7.tooling\u002F1.cli","i-lucide-square-terminal",{"title":567,"path":568,"stem":569,"icon":570},"ESLint config","\u002Fcontribute\u002Ftooling\u002Feslint-config","5.contribute\u002F7.tooling\u002F2.eslint-config","i-lucide-spell-check",{"title":572,"icon":49,"path":573,"stem":574,"children":575},"Decisions","\u002Fcontribute\u002Fdecisions","5.contribute\u002F8.decisions\u002Findex",[576,578,583],{"title":572,"path":573,"stem":574,"icon":577},"i-lucide-scale",{"title":579,"path":580,"stem":581,"icon":582},"Session lifetimes per OAuth client","\u002Fcontribute\u002Fdecisions\u002Foauth-token-lifetimes","5.contribute\u002F8.decisions\u002F1.oauth-token-lifetimes","i-lucide-timer",{"title":584,"path":585,"stem":586,"icon":70},"One permission model","\u002Fcontribute\u002Fdecisions\u002Fpermission-model","5.contribute\u002F8.decisions\u002F2.permission-model",{"id":588,"title":209,"body":589,"description":1751,"extension":1752,"links":1753,"meta":1754,"navigation":1755,"path":210,"seo":1756,"stem":211,"__hash__":1757},"docs\u002F3.modules\u002F1.identity\u002F4.authorization\u002F3.policies.md",{"type":590,"value":591,"toc":1743},"minimark",[592,613,618,634,690,697,704,907,914,918,934,1075,1118,1125,1129,1151,1314,1391,1434,1444,1448,1455,1662,1688,1696,1700,1711,1715,1739],[593,594,595,596,600,601,604,605,608,609,612],"p",{},"A role says \"coordinators may update events\". A ",[597,598,599],"strong",{},"policy"," says \"but only events of their own region\". It is code that\nrefines ",[597,602,603],{},"one permission"," for ",[597,606,607],{},"one record",". This page shows how to write server and shared policies, what they can\nand cannot do, and the two-step route that runs them. Set up the module first:\n",[610,611,173],"a",{"href":200},".",[614,615,617],"h2",{"id":616},"narrowing-never-granting","Narrowing, never granting",[593,619,620,621,624,625,629,630,633],{},"A policy only ",[597,622,623],{},"refines"," a result. By the time it runs, the credential, the before hook and the roles already allowed\nthe permission, so ",[626,627,628],"code",{},"granted"," is always ",[626,631,632],{},"true",". A policy returns:",[635,636,637,650],"table",{},[638,639,640],"thead",{},[641,642,643,647],"tr",{},[644,645,646],"th",{},"Result",[644,648,649],{},"Effect",[651,652,653,668],"tbody",{},[641,654,655,662],{},[656,657,658,661],"td",{},[626,659,660],{},"false",", or it throws",[656,663,664,665,667],{},"Denies. Any ",[626,666,660],{}," wins over every other policy (deny wins).",[641,669,670,678],{},[656,671,672,674,675],{},[626,673,632],{}," or ",[626,676,677],{},"undefined",[656,679,680,681,683,684,687,688,612],{},"Keeps the current result. ",[626,682,632],{}," does ",[597,685,686],{},"not"," override another policy's ",[626,689,660],{},[593,691,692,693,696],{},"So a policy cannot turn a denial into an allow. It also never runs when the roles do not hold the permission, or after\n",[626,694,695],{},"authorization:before"," has allowed the request. Policies run in order: modules first, then your app.",[593,698,699,700,703],{},"An \"owner may edit\" rule is therefore built on a permission everyone who should be able to try already holds (a default\nrole or an ",[626,701,702],{},"implicit"," permission), and the policy removes everyone else:",[705,706,712],"pre",{"className":707,"code":708,"filename":709,"language":710,"meta":711,"style":711},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","export default [\n  \u002F\u002F `posts:update` is granted to every user; only the author, or someone who also holds `posts:moderate`, passes.\n  definePolicy\u003CPost>('posts:update', async ({ event, user, record }) => {\n    if (record!.authorId === Number(user.id)) return undefined \u002F\u002F keep: they hold the permission\n    return await allows(event, 'posts:moderate') ? undefined : false\n  }),\n]\n","server\u002Fpolicies.ts","ts","",[626,713,714,730,737,800,847,889,901],{"__ignoreMap":711},[715,716,719,723,726],"span",{"class":717,"line":718},"line",1,[715,720,722],{"class":721},"s7zQu","export",[715,724,725],{"class":721}," default",[715,727,729],{"class":728},"sTEyZ"," [\n",[715,731,733],{"class":717,"line":732},2,[715,734,736],{"class":735},"sHwdD","  \u002F\u002F `posts:update` is granted to every user; only the author, or someone who also holds `posts:moderate`, passes.\n",[715,738,740,744,748,752,755,758,761,765,767,770,774,777,781,783,786,788,791,794,797],{"class":717,"line":739},3,[715,741,743],{"class":742},"s2Zo4","  definePolicy",[715,745,747],{"class":746},"sMK4o","\u003C",[715,749,751],{"class":750},"sBMFI","Post",[715,753,754],{"class":746},">",[715,756,757],{"class":728},"(",[715,759,760],{"class":746},"'",[715,762,764],{"class":763},"sfazB","posts:update",[715,766,760],{"class":746},[715,768,769],{"class":746},",",[715,771,773],{"class":772},"spNyl"," async",[715,775,776],{"class":746}," ({",[715,778,780],{"class":779},"sHdIc"," event",[715,782,769],{"class":746},[715,784,785],{"class":779}," user",[715,787,769],{"class":746},[715,789,790],{"class":779}," record",[715,792,793],{"class":746}," })",[715,795,796],{"class":772}," =>",[715,798,799],{"class":746}," {\n",[715,801,803,806,810,813,816,819,822,825,827,830,832,835,838,841,844],{"class":717,"line":802},4,[715,804,805],{"class":721},"    if",[715,807,809],{"class":808},"swJcz"," (",[715,811,812],{"class":728},"record",[715,814,815],{"class":746},"!.",[715,817,818],{"class":728},"authorId",[715,820,821],{"class":746}," ===",[715,823,824],{"class":742}," Number",[715,826,757],{"class":808},[715,828,829],{"class":728},"user",[715,831,612],{"class":746},[715,833,834],{"class":728},"id",[715,836,837],{"class":808},")) ",[715,839,840],{"class":721},"return",[715,842,843],{"class":746}," undefined",[715,845,846],{"class":735}," \u002F\u002F keep: they hold the permission\n",[715,848,850,853,856,859,861,864,866,869,872,874,877,880,882,885],{"class":717,"line":849},5,[715,851,852],{"class":721},"    return",[715,854,855],{"class":721}," await",[715,857,858],{"class":742}," allows",[715,860,757],{"class":808},[715,862,863],{"class":728},"event",[715,865,769],{"class":746},[715,867,868],{"class":746}," '",[715,870,871],{"class":763},"posts:moderate",[715,873,760],{"class":746},[715,875,876],{"class":808},") ",[715,878,879],{"class":746},"?",[715,881,843],{"class":746},[715,883,884],{"class":746}," :",[715,886,888],{"class":887},"sfNiH"," false\n",[715,890,892,895,898],{"class":717,"line":891},6,[715,893,894],{"class":746},"  }",[715,896,897],{"class":728},")",[715,899,900],{"class":746},",\n",[715,902,904],{"class":717,"line":903},7,[715,905,906],{"class":728},"]\n",[593,908,909,910,913],{},"Or the other way round, on top of a role grant: ",[626,911,912],{},"record.ownerId === user.id || undefined"," keeps the result for the\nowner, and, for everyone else, leaves it to the role. Pick the shape where the role grant already matches who may try.",[614,915,917],{"id":916},"server-policies","Server policies",[593,919,920,923,924,926,927,930,931,612],{},[626,921,922],{},"definePolicy"," is auto-imported in server code. Export the policies from ",[626,925,709],{}," (the default location), or\nregister another file with the ",[626,928,929],{},"authorization.policies.server"," option. A module registers its own file with\n",[626,932,933],{},"addPolicies(nuxt, { path })",[705,935,937],{"className":707,"code":936,"language":710,"meta":711,"style":711},"definePolicy\u003CR>(permission, fn, { withoutRecord?: boolean })\n\ninterface PolicyContext\u003CR> {\n  event: H3Event\n  user: AuthUser\n  principal: AuthPrincipal \u002F\u002F kind, scopes, frozen permissions\n  record: R | undefined\n  granted: boolean \u002F\u002F always true when a policy runs\n}\n\u002F\u002F fn returns boolean | undefined, or a promise of it\n",[626,938,939,978,984,1000,1010,1020,1033,1049,1063,1069],{"__ignoreMap":711},[715,940,941,943,945,948,950,953,955,958,960,963,966,969,972,975],{"class":717,"line":718},[715,942,922],{"class":742},[715,944,747],{"class":746},[715,946,947],{"class":750},"R",[715,949,754],{"class":746},[715,951,952],{"class":728},"(permission",[715,954,769],{"class":746},[715,956,957],{"class":728}," fn",[715,959,769],{"class":746},[715,961,962],{"class":746}," {",[715,964,965],{"class":728}," withoutRecord?",[715,967,968],{"class":746},":",[715,970,971],{"class":728}," boolean ",[715,973,974],{"class":746},"}",[715,976,977],{"class":728},")\n",[715,979,980],{"class":717,"line":732},[715,981,983],{"emptyLinePlaceholder":982},true,"\n",[715,985,986,989,992,994,996,998],{"class":717,"line":739},[715,987,988],{"class":772},"interface",[715,990,991],{"class":750}," PolicyContext",[715,993,747],{"class":746},[715,995,947],{"class":750},[715,997,754],{"class":746},[715,999,799],{"class":746},[715,1001,1002,1005,1007],{"class":717,"line":802},[715,1003,1004],{"class":808},"  event",[715,1006,968],{"class":746},[715,1008,1009],{"class":750}," H3Event\n",[715,1011,1012,1015,1017],{"class":717,"line":849},[715,1013,1014],{"class":808},"  user",[715,1016,968],{"class":746},[715,1018,1019],{"class":750}," AuthUser\n",[715,1021,1022,1025,1027,1030],{"class":717,"line":891},[715,1023,1024],{"class":808},"  principal",[715,1026,968],{"class":746},[715,1028,1029],{"class":750}," AuthPrincipal",[715,1031,1032],{"class":735}," \u002F\u002F kind, scopes, frozen permissions\n",[715,1034,1035,1038,1040,1043,1046],{"class":717,"line":903},[715,1036,1037],{"class":808},"  record",[715,1039,968],{"class":746},[715,1041,1042],{"class":750}," R",[715,1044,1045],{"class":746}," |",[715,1047,1048],{"class":750}," undefined\n",[715,1050,1052,1055,1057,1060],{"class":717,"line":1051},8,[715,1053,1054],{"class":808},"  granted",[715,1056,968],{"class":746},[715,1058,1059],{"class":750}," boolean",[715,1061,1062],{"class":735}," \u002F\u002F always true when a policy runs\n",[715,1064,1066],{"class":717,"line":1065},9,[715,1067,1068],{"class":746},"}\n",[715,1070,1072],{"class":717,"line":1071},10,[715,1073,1074],{"class":735},"\u002F\u002F fn returns boolean | undefined, or a promise of it\n",[1076,1077,1078,1085,1095,1109,1115],"ul",{},[1079,1080,1081,1084],"li",{},[597,1082,1083],{},"Async is fine."," A server policy may query the database. A thrown error is logged and denies.",[1079,1086,1087,1090,1091,1094],{},[597,1088,1089],{},"A record is required by default."," A policy only runs for a check with a record (",[626,1092,1093],{},"authorize(event, p, record)",").\nA check without one skips it, so the first step of a route is cheap and never loads data.",[1079,1096,1097,1102,1103,1105,1106,1108],{},[597,1098,1099],{},[626,1100,1101],{},"withoutRecord: true"," also runs it for checks without a record. Use it for rules that do not depend on one, such\nas a tenant or a suspended account. The ",[626,1104,812],{}," is ",[626,1107,677],{}," there.",[1079,1110,1111,1114],{},[597,1112,1113],{},"A policy of an unregistered permission never runs."," In development the server logs an error naming it.",[1079,1116,1117],{},"Policy results are never cached, a decision without a record is cached per request.",[593,1119,1120,1121,1124],{},"A policy sees ",[626,1122,1123],{},"principal",", so it can treat API tokens differently. It cannot widen what the token's own permissions\nallow: that check comes first.",[614,1126,1128],{"id":1127},"shared-policies","Shared policies",[593,1130,1131,1132,1135,1136,1139,1140,1143,1144,1146,1147,1150],{},"The client's ",[626,1133,1134],{},"can()"," is synchronous and has no database, so a rule the interface should know about is written once as\na ",[597,1137,1138],{},"shared policy",". It runs on the server (inside every ",[626,1141,1142],{},"authorize",") and in the browser (inside ",[626,1145,1134],{}," and\n",[626,1148,1149],{},"\u003CCan>","):",[705,1152,1155],{"className":707,"code":1153,"filename":1154,"language":710,"meta":711,"style":711},"import { defineSharedPolicy } from '@frigear-nu\u002Fauth\u002Fpolicies'\n\nexport default [\n  defineSharedPolicy\u003CPost>('posts:update', ({ user, access, record }) => {\n    if (!record) return undefined\n    return record.authorId === user?.id || access?.permissions.includes('posts:moderate') ? undefined : false\n  }),\n]\n","shared\u002Fpolicies.ts",[626,1156,1157,1181,1185,1193,1233,1250,1302,1310],{"__ignoreMap":711},[715,1158,1159,1162,1164,1167,1170,1173,1175,1178],{"class":717,"line":718},[715,1160,1161],{"class":721},"import",[715,1163,962],{"class":746},[715,1165,1166],{"class":728}," defineSharedPolicy",[715,1168,1169],{"class":746}," }",[715,1171,1172],{"class":721}," from",[715,1174,868],{"class":746},[715,1176,1177],{"class":763},"@frigear-nu\u002Fauth\u002Fpolicies",[715,1179,1180],{"class":746},"'\n",[715,1182,1183],{"class":717,"line":732},[715,1184,983],{"emptyLinePlaceholder":982},[715,1186,1187,1189,1191],{"class":717,"line":739},[715,1188,722],{"class":721},[715,1190,725],{"class":721},[715,1192,729],{"class":728},[715,1194,1195,1198,1200,1202,1204,1206,1208,1210,1212,1214,1216,1218,1220,1223,1225,1227,1229,1231],{"class":717,"line":802},[715,1196,1197],{"class":742},"  defineSharedPolicy",[715,1199,747],{"class":746},[715,1201,751],{"class":750},[715,1203,754],{"class":746},[715,1205,757],{"class":728},[715,1207,760],{"class":746},[715,1209,764],{"class":763},[715,1211,760],{"class":746},[715,1213,769],{"class":746},[715,1215,776],{"class":746},[715,1217,785],{"class":779},[715,1219,769],{"class":746},[715,1221,1222],{"class":779}," access",[715,1224,769],{"class":746},[715,1226,790],{"class":779},[715,1228,793],{"class":746},[715,1230,796],{"class":772},[715,1232,799],{"class":746},[715,1234,1235,1237,1239,1242,1244,1246,1248],{"class":717,"line":849},[715,1236,805],{"class":721},[715,1238,809],{"class":808},[715,1240,1241],{"class":746},"!",[715,1243,812],{"class":728},[715,1245,876],{"class":808},[715,1247,840],{"class":721},[715,1249,1048],{"class":746},[715,1251,1252,1254,1256,1258,1260,1262,1264,1267,1269,1272,1274,1276,1279,1281,1284,1286,1288,1290,1292,1294,1296,1298,1300],{"class":717,"line":891},[715,1253,852],{"class":721},[715,1255,790],{"class":728},[715,1257,612],{"class":746},[715,1259,818],{"class":728},[715,1261,821],{"class":746},[715,1263,785],{"class":728},[715,1265,1266],{"class":746},"?.",[715,1268,834],{"class":728},[715,1270,1271],{"class":746}," ||",[715,1273,1222],{"class":728},[715,1275,1266],{"class":746},[715,1277,1278],{"class":728},"permissions",[715,1280,612],{"class":746},[715,1282,1283],{"class":742},"includes",[715,1285,757],{"class":808},[715,1287,760],{"class":746},[715,1289,871],{"class":763},[715,1291,760],{"class":746},[715,1293,876],{"class":808},[715,1295,879],{"class":746},[715,1297,843],{"class":746},[715,1299,884],{"class":746},[715,1301,888],{"class":887},[715,1303,1304,1306,1308],{"class":717,"line":903},[715,1305,894],{"class":746},[715,1307,897],{"class":728},[715,1309,900],{"class":746},[715,1311,1312],{"class":717,"line":1051},[715,1313,906],{"class":728},[705,1315,1317],{"className":707,"code":1316,"language":710,"meta":711,"style":711},"interface SharedPolicyContext\u003CR> {\n  user: User | null\n  access: AccessDto | null \u002F\u002F what the caller may do: the same shape on the server and the client\n  record: R | undefined\n  granted: boolean\n}\n",[626,1318,1319,1334,1348,1366,1378,1387],{"__ignoreMap":711},[715,1320,1321,1323,1326,1328,1330,1332],{"class":717,"line":718},[715,1322,988],{"class":772},[715,1324,1325],{"class":750}," SharedPolicyContext",[715,1327,747],{"class":746},[715,1329,947],{"class":750},[715,1331,754],{"class":746},[715,1333,799],{"class":746},[715,1335,1336,1338,1340,1343,1345],{"class":717,"line":732},[715,1337,1014],{"class":808},[715,1339,968],{"class":746},[715,1341,1342],{"class":750}," User",[715,1344,1045],{"class":746},[715,1346,1347],{"class":750}," null\n",[715,1349,1350,1353,1355,1358,1360,1363],{"class":717,"line":739},[715,1351,1352],{"class":808},"  access",[715,1354,968],{"class":746},[715,1356,1357],{"class":750}," AccessDto",[715,1359,1045],{"class":746},[715,1361,1362],{"class":750}," null",[715,1364,1365],{"class":735}," \u002F\u002F what the caller may do: the same shape on the server and the client\n",[715,1367,1368,1370,1372,1374,1376],{"class":717,"line":802},[715,1369,1037],{"class":808},[715,1371,968],{"class":746},[715,1373,1042],{"class":750},[715,1375,1045],{"class":746},[715,1377,1048],{"class":750},[715,1379,1380,1382,1384],{"class":717,"line":849},[715,1381,1054],{"class":808},[715,1383,968],{"class":746},[715,1385,1386],{"class":750}," boolean\n",[715,1388,1389],{"class":717,"line":891},[715,1390,1068],{"class":746},[1076,1392,1393,1399,1415,1422],{},[1079,1394,1395,1398],{},[597,1396,1397],{},"Synchronous only."," A shared policy that returns a promise counts as an error, which denies.",[1079,1400,1401,1404,1405,1407,1408,900,1411,1414],{},[597,1402,1403],{},"Framework free."," Import only from ",[626,1406,1177],{},". The build fails when the file imports ",[626,1409,1410],{},"#imports",[626,1412,1413],{},"@nuxthub\u002Fdb"," or other server or Nuxt code, because it is also bundled into the client and into resource servers.",[1079,1416,1417,1418,1421],{},"On the server ",[626,1419,1420],{},"access"," is the caller's role permissions (no hook, no policies), so evaluating it never recurses.",[1079,1423,1424,1425,1428,1429,1431,1432,612],{},"Register the file with ",[626,1426,1427],{},"authorization.policies.shared"," (default ",[626,1430,1154],{},") or ",[626,1433,933],{},[1435,1436,1437,1438,1440,1441,1443],"warning",{},"A shared policy shapes the interface. The server runs it too, but it only has what ",[626,1439,1420],{}," and ",[626,1442,829],{}," hold. Anything\nthat needs the database belongs in a server policy.",[614,1445,1447],{"id":1446},"the-two-step-route","The two-step route",[593,1449,1450,1451,1454],{},"A handler authorizes ",[597,1452,1453],{},"twice",": once without the record, so a visitor or a user without the permission is turned away\nbefore anything is loaded, and once with the record, so the policies decide.",[705,1456,1459],{"className":707,"code":1457,"filename":1458,"language":710,"meta":711,"style":711},"export default defineEventHandler(async (event) => {\n  await authorize(event, 'posts:update') \u002F\u002F 401 or 403: nothing loaded, nothing leaked\n  const { id } = await getValidatedRouterParams(event, intIdParams().parse)\n  const post = await findPost(id) \u002F\u002F 404 only for someone who may try\n  await authorize(event, 'posts:update', post) \u002F\u002F the policies run against this record\n  const body = await readValidatedBody(event, updatePost.parse)\n  return toPostDto(await savePost(post, body))\n})\n","server\u002Fapi\u002Fposts\u002F[id].put.ts",[626,1460,1461,1485,1510,1549,1572,1599,1628,1656],{"__ignoreMap":711},[715,1462,1463,1465,1467,1470,1472,1475,1477,1479,1481,1483],{"class":717,"line":718},[715,1464,722],{"class":721},[715,1466,725],{"class":721},[715,1468,1469],{"class":742}," defineEventHandler",[715,1471,757],{"class":728},[715,1473,1474],{"class":772},"async",[715,1476,809],{"class":746},[715,1478,863],{"class":779},[715,1480,897],{"class":746},[715,1482,796],{"class":772},[715,1484,799],{"class":746},[715,1486,1487,1490,1493,1495,1497,1499,1501,1503,1505,1507],{"class":717,"line":732},[715,1488,1489],{"class":721},"  await",[715,1491,1492],{"class":742}," authorize",[715,1494,757],{"class":808},[715,1496,863],{"class":728},[715,1498,769],{"class":746},[715,1500,868],{"class":746},[715,1502,764],{"class":763},[715,1504,760],{"class":746},[715,1506,876],{"class":808},[715,1508,1509],{"class":735},"\u002F\u002F 401 or 403: nothing loaded, nothing leaked\n",[715,1511,1512,1515,1517,1520,1522,1525,1527,1530,1532,1534,1536,1539,1542,1544,1547],{"class":717,"line":739},[715,1513,1514],{"class":772},"  const",[715,1516,962],{"class":746},[715,1518,1519],{"class":728}," id",[715,1521,1169],{"class":746},[715,1523,1524],{"class":746}," =",[715,1526,855],{"class":721},[715,1528,1529],{"class":742}," getValidatedRouterParams",[715,1531,757],{"class":808},[715,1533,863],{"class":728},[715,1535,769],{"class":746},[715,1537,1538],{"class":742}," intIdParams",[715,1540,1541],{"class":808},"()",[715,1543,612],{"class":746},[715,1545,1546],{"class":728},"parse",[715,1548,977],{"class":808},[715,1550,1551,1553,1556,1558,1560,1563,1565,1567,1569],{"class":717,"line":802},[715,1552,1514],{"class":772},[715,1554,1555],{"class":728}," post",[715,1557,1524],{"class":746},[715,1559,855],{"class":721},[715,1561,1562],{"class":742}," findPost",[715,1564,757],{"class":808},[715,1566,834],{"class":728},[715,1568,876],{"class":808},[715,1570,1571],{"class":735},"\u002F\u002F 404 only for someone who may try\n",[715,1573,1574,1576,1578,1580,1582,1584,1586,1588,1590,1592,1594,1596],{"class":717,"line":849},[715,1575,1489],{"class":721},[715,1577,1492],{"class":742},[715,1579,757],{"class":808},[715,1581,863],{"class":728},[715,1583,769],{"class":746},[715,1585,868],{"class":746},[715,1587,764],{"class":763},[715,1589,760],{"class":746},[715,1591,769],{"class":746},[715,1593,1555],{"class":728},[715,1595,876],{"class":808},[715,1597,1598],{"class":735},"\u002F\u002F the policies run against this record\n",[715,1600,1601,1603,1606,1608,1610,1613,1615,1617,1619,1622,1624,1626],{"class":717,"line":891},[715,1602,1514],{"class":772},[715,1604,1605],{"class":728}," body",[715,1607,1524],{"class":746},[715,1609,855],{"class":721},[715,1611,1612],{"class":742}," readValidatedBody",[715,1614,757],{"class":808},[715,1616,863],{"class":728},[715,1618,769],{"class":746},[715,1620,1621],{"class":728}," updatePost",[715,1623,612],{"class":746},[715,1625,1546],{"class":728},[715,1627,977],{"class":808},[715,1629,1630,1633,1636,1638,1641,1644,1646,1649,1651,1653],{"class":717,"line":903},[715,1631,1632],{"class":721},"  return",[715,1634,1635],{"class":742}," toPostDto",[715,1637,757],{"class":808},[715,1639,1640],{"class":721},"await",[715,1642,1643],{"class":742}," savePost",[715,1645,757],{"class":808},[715,1647,1648],{"class":728},"post",[715,1650,769],{"class":746},[715,1652,1605],{"class":728},[715,1654,1655],{"class":808},"))\n",[715,1657,1658,1660],{"class":717,"line":1051},[715,1659,974],{"class":746},[715,1661,977],{"class":728},[593,1663,1664,1665,1668,1669,674,1672,1675,1676,1679,1680,1683,1684,1687],{},"Never answer ",[626,1666,1667],{},"404"," before ",[626,1670,1671],{},"401",[626,1673,1674],{},"403",", and never skip the second call because \"the first one passed\": the first\ncall runs no record policy. For lists, filter with ",[626,1677,1678],{},"allows(event, permission, record)"," per row, or in the query; and use\n",[626,1681,1682],{},"inspect"," when the reason matters (",[626,1685,1686],{},"via: 'before' | 'role' | 'policy'",").",[593,1689,1690,1693,1694,612],{},[626,1691,1692],{},"null"," counts as no record, like ",[626,1695,677],{},[614,1697,1699],{"id":1698},"policies-and-tokens","Policies and tokens",[593,1701,1702,1703,1706,1707,1710],{},"Policies run for every credential kind, with a record. They do not run for token ",[597,1704,1705],{},"minting"," and OAuth consent\n(",[626,1708,1709],{},"canGrantScope","), which decide on permissions alone: a policy cannot be frozen into a token.",[614,1712,1714],{"id":1713},"next-steps","Next steps",[1076,1716,1717,1728,1733],{},[1079,1718,1719,1721,1722,1440,1725,612],{},[610,1720,213],{"href":214}," – ",[626,1723,1724],{},"can(permission, record)",[626,1726,1727],{},"\u003CCan :record>",[1079,1729,1730,1732],{},[610,1731,121],{"href":122}," – the handler order the two-step route follows.",[1079,1734,1735,1738],{},[610,1736,67],{"href":1737},"\u002Fguide\u002Fconcepts\u002Fauth-and-scopes#policies"," – where policies sit in the order of a check.",[1740,1741,1742],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":711,"searchDepth":732,"depth":732,"links":1744},[1745,1746,1747,1748,1749,1750],{"id":616,"depth":732,"text":617},{"id":916,"depth":732,"text":917},{"id":1127,"depth":732,"text":1128},{"id":1446,"depth":732,"text":1447},{"id":1698,"depth":732,"text":1699},{"id":1713,"depth":732,"text":1714},"Refine one permission against a record, such as \"only the author may edit\", on the server and in the interface.","md",null,{},{"title":209},{"title":209,"description":1751},"VRmGEupNVv5yBexvH57MkO6NEw2oGO-vJQHu0_1n6yE",[1759,1761],{"title":205,"path":206,"stem":207,"description":1760,"children":-1},"How roles are built from host config and module defaults, how users get them, and how to keep a role tied to a condition such as a subscription.",{"title":213,"path":214,"stem":215,"description":1762,"children":-1},"useAuthorization(), Can and Cannot, route rules, page meta and filtered menus, plus access in client mode and mobile apps.",1794503154224]