[{"data":1,"prerenderedAt":2423},["ShallowReactive",2],{"navigation_docs":3,"-modules-identity-oauth-server-hooks":587,"-modules-identity-oauth-server-hooks-surround":2418},[4,50,155,441,504],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":49},"Get Started","i-lucide-rocket","\u002Fget-started","1.get-started",[10,15,20,25,30,35,40,45],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fget-started\u002Fintroduction","1.get-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Installation","\u002Fget-started\u002Finstallation","1.get-started\u002F2.installation","i-lucide-download",{"title":21,"path":22,"stem":23,"icon":24},"Project structure","\u002Fget-started\u002Fproject-structure","1.get-started\u002F3.project-structure","i-lucide-folder-tree",{"title":26,"path":27,"stem":28,"icon":29},"Configuration","\u002Fget-started\u002Fconfiguration","1.get-started\u002F4.configuration","i-lucide-settings",{"title":31,"path":32,"stem":33,"icon":34},"Authentication","\u002Fget-started\u002Fauthentication","1.get-started\u002F5.authentication","i-lucide-lock",{"title":36,"path":37,"stem":38,"icon":39},"Adding modules","\u002Fget-started\u002Fadding-modules","1.get-started\u002F6.adding-modules","i-lucide-puzzle",{"title":41,"path":42,"stem":43,"icon":44},"Database","\u002Fget-started\u002Fdatabase","1.get-started\u002F7.database","i-lucide-database",{"title":46,"path":47,"stem":48,"icon":6},"Deployment","\u002Fget-started\u002Fdeployment","1.get-started\u002F8.deployment",false,{"title":51,"icon":52,"path":53,"stem":54,"children":55,"page":49},"Guide","i-lucide-book-open","\u002Fguide","2.guide",[56,90,115,125],{"title":57,"icon":49,"path":58,"stem":59,"children":60,"page":49},"Concepts","\u002Fguide\u002Fconcepts","2.guide\u002F1.concepts",[61,66,71,76,80,85],{"title":62,"path":63,"stem":64,"icon":65},"Architecture","\u002Fguide\u002Fconcepts\u002Farchitecture","2.guide\u002F1.concepts\u002F1.architecture","i-lucide-blocks",{"title":67,"path":68,"stem":69,"icon":70},"Access control","\u002Fguide\u002Fconcepts\u002Fauth-and-scopes","2.guide\u002F1.concepts\u002F2.auth-and-scopes","i-lucide-shield-check",{"title":72,"path":73,"stem":74,"icon":75},"Extension points","\u002Fguide\u002Fconcepts\u002Fextension-points","2.guide\u002F1.concepts\u002F3.extension-points","i-lucide-plug",{"title":77,"path":78,"stem":79,"icon":44},"Database extensions","\u002Fguide\u002Fconcepts\u002Fdatabase-extensions","2.guide\u002F1.concepts\u002F4.database-extensions",{"title":81,"path":82,"stem":83,"icon":84},"Identity","\u002Fguide\u002Fconcepts\u002Fidentity","2.guide\u002F1.concepts\u002F5.identity","i-lucide-fingerprint",{"title":86,"path":87,"stem":88,"icon":89},"Glossary","\u002Fguide\u002Fconcepts\u002Fglossary","2.guide\u002F1.concepts\u002F6.glossary","i-lucide-book-a",{"title":91,"icon":49,"path":92,"stem":93,"children":94,"page":49},"UX patterns","\u002Fguide\u002Fux-patterns","2.guide\u002F2.ux-patterns",[95,100,105,110],{"title":96,"path":97,"stem":98,"icon":99},"Layouts and navigation","\u002Fguide\u002Fux-patterns\u002Flayouts-and-navigation","2.guide\u002F2.ux-patterns\u002F1.layouts-and-navigation","i-lucide-layout-template",{"title":101,"path":102,"stem":103,"icon":104},"Pages","\u002Fguide\u002Fux-patterns\u002Fpages","2.guide\u002F2.ux-patterns\u002F2.pages","i-lucide-table",{"title":106,"path":107,"stem":108,"icon":109},"Forms and actions","\u002Fguide\u002Fux-patterns\u002Fforms-and-actions","2.guide\u002F2.ux-patterns\u002F3.forms-and-actions","i-lucide-square-pen",{"title":111,"path":112,"stem":113,"icon":114},"Text and formatting","\u002Fguide\u002Fux-patterns\u002Ftext-and-formatting","2.guide\u002F2.ux-patterns\u002F4.text-and-formatting","i-lucide-type",{"title":116,"icon":49,"path":117,"stem":118,"children":119,"page":49},"Best practices","\u002Fguide\u002Fbest-practices","2.guide\u002F3.best-practices",[120],{"title":121,"path":122,"stem":123,"icon":124},"HTTP routes","\u002Fguide\u002Fbest-practices\u002Fhttp-routes","2.guide\u002F3.best-practices\u002F1.http-routes","i-lucide-route",{"title":126,"icon":49,"path":127,"stem":128,"children":129,"page":49},"Going further","\u002Fguide\u002Fgoing-further","2.guide\u002F4.going-further",[130,135,140,145,150],{"title":131,"path":132,"stem":133,"icon":134},"Use your own OAuth server","\u002Fguide\u002Fgoing-further\u002Fown-oauth-server","2.guide\u002F4.going-further\u002F1.own-oauth-server","i-lucide-key-round",{"title":136,"path":137,"stem":138,"icon":139},"Create an OAuth application","\u002Fguide\u002Fgoing-further\u002Foauth-application","2.guide\u002F4.going-further\u002F2.oauth-application","i-lucide-app-window",{"title":141,"path":142,"stem":143,"icon":144},"Signing keys","\u002Fguide\u002Fgoing-further\u002Fsigning-keys","2.guide\u002F4.going-further\u002F3.signing-keys","i-lucide-key-square",{"title":146,"path":147,"stem":148,"icon":149},"Stripe setup","\u002Fguide\u002Fgoing-further\u002Fstripe-setup","2.guide\u002F4.going-further\u002F4.stripe-setup","i-lucide-credit-card",{"title":151,"path":152,"stem":153,"icon":154},"Migrate to the permission model","\u002Fguide\u002Fgoing-further\u002Fmigrate-access-control","2.guide\u002F4.going-further\u002F5.migrate-access-control","i-lucide-arrow-right-left",{"title":156,"icon":157,"path":158,"stem":159,"children":160},"Modules","i-lucide-boxes","\u002Fmodules","3.modules",[161,163,244,273,320,375],{"title":156,"path":158,"stem":162},"3.modules\u002Findex",{"title":81,"icon":49,"path":164,"stem":165,"children":166,"page":49},"\u002Fmodules\u002Fidentity","3.modules\u002F1.identity",[167,190,194,198,220,224,240],{"title":168,"path":169,"stem":170,"children":171},"Auth","\u002Fmodules\u002Fidentity\u002Fauth","3.modules\u002F1.identity\u002F1.auth\u002Findex",[172,174,178,182,186],{"title":173,"path":169,"stem":170},"Overview",{"title":175,"path":176,"stem":177},"Server API","\u002Fmodules\u002Fidentity\u002Fauth\u002Fserver","3.modules\u002F1.identity\u002F1.auth\u002F2.server",{"title":179,"path":180,"stem":181},"Reference","\u002Fmodules\u002Fidentity\u002Fauth\u002Freference","3.modules\u002F1.identity\u002F1.auth\u002F3.reference",{"title":183,"path":184,"stem":185},"Client mode","\u002Fmodules\u002Fidentity\u002Fauth\u002Fclient-mode","3.modules\u002F1.identity\u002F1.auth\u002F4.client-mode",{"title":187,"path":188,"stem":189},"OAuth providers","\u002Fmodules\u002Fidentity\u002Fauth\u002Foauth-providers","3.modules\u002F1.identity\u002F1.auth\u002F5.oauth-providers",{"title":191,"path":192,"stem":193},"Users","\u002Fmodules\u002Fidentity\u002Fusers","3.modules\u002F1.identity\u002F2.users",{"title":195,"path":196,"stem":197},"Account","\u002Fmodules\u002Fidentity\u002Faccount","3.modules\u002F1.identity\u002F3.account",{"title":199,"path":200,"stem":201,"children":202},"Authorization","\u002Fmodules\u002Fidentity\u002Fauthorization","3.modules\u002F1.identity\u002F4.authorization\u002Findex",[203,204,208,212,216],{"title":173,"path":200,"stem":201},{"title":205,"path":206,"stem":207},"Roles and requirements","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Froles-and-requirements","3.modules\u002F1.identity\u002F4.authorization\u002F2.roles-and-requirements",{"title":209,"path":210,"stem":211},"Policies","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fpolicies","3.modules\u002F1.identity\u002F4.authorization\u002F3.policies",{"title":213,"path":214,"stem":215},"Client","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fclient","3.modules\u002F1.identity\u002F4.authorization\u002F4.client",{"title":217,"path":218,"stem":219},"Admin","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fadmin","3.modules\u002F1.identity\u002F4.authorization\u002F5.admin",{"title":221,"path":222,"stem":223},"Preferences","\u002Fmodules\u002Fidentity\u002Fpreferences","3.modules\u002F1.identity\u002F5.preferences",{"title":225,"path":226,"stem":227,"children":228},"OAuth Server","\u002Fmodules\u002Fidentity\u002Foauth-server","3.modules\u002F1.identity\u002F6.oauth-server\u002Findex",[229,230,233,237],{"title":173,"path":226,"stem":227},{"title":175,"path":231,"stem":232},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fserver","3.modules\u002F1.identity\u002F6.oauth-server\u002F2.server",{"title":234,"path":235,"stem":236},"Hooks","\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fhooks","3.modules\u002F1.identity\u002F6.oauth-server\u002F3.hooks",{"title":179,"path":238,"stem":239},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Froutes-and-clients","3.modules\u002F1.identity\u002F6.oauth-server\u002F4.routes-and-clients",{"title":241,"path":242,"stem":243},"OAuth Resource","\u002Fmodules\u002Fidentity\u002Foauth-resource","3.modules\u002F1.identity\u002F8.oauth-resource",{"title":245,"icon":49,"path":246,"stem":247,"children":248,"page":49},"Commerce","\u002Fmodules\u002Fcommerce","3.modules\u002F2.commerce",[249,253,257],{"title":250,"path":251,"stem":252},"Stripe","\u002Fmodules\u002Fcommerce\u002Fstripe","3.modules\u002F2.commerce\u002F1.stripe",{"title":254,"path":255,"stem":256},"Payments","\u002Fmodules\u002Fcommerce\u002Fpayments","3.modules\u002F2.commerce\u002F2.payments",{"title":258,"path":259,"stem":260,"children":261},"Subscriptions","\u002Fmodules\u002Fcommerce\u002Fsubscriptions","3.modules\u002F2.commerce\u002F3.subscriptions\u002Findex",[262,263,266,270],{"title":173,"path":259,"stem":260},{"title":175,"path":264,"stem":265},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fserver","3.modules\u002F2.commerce\u002F3.subscriptions\u002F2.server",{"title":267,"path":268,"stem":269},"App","\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fapp","3.modules\u002F2.commerce\u002F3.subscriptions\u002F3.app",{"title":179,"path":271,"stem":272},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Freference","3.modules\u002F2.commerce\u002F3.subscriptions\u002F4.reference",{"title":274,"icon":49,"path":275,"stem":276,"children":277,"page":49},"Features","\u002Fmodules\u002Ffeatures","3.modules\u002F3.features",[278,293,312,316],{"title":279,"path":280,"stem":281,"children":282},"Events","\u002Fmodules\u002Ffeatures\u002Fevents","3.modules\u002F3.features\u002F1.events\u002Findex",[283,284,287,290],{"title":173,"path":280,"stem":281},{"title":175,"path":285,"stem":286},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fserver","3.modules\u002F3.features\u002F1.events\u002F2.server",{"title":267,"path":288,"stem":289},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fapp","3.modules\u002F3.features\u002F1.events\u002F3.app",{"title":179,"path":291,"stem":292},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Freference","3.modules\u002F3.features\u002F1.events\u002F4.reference",{"title":294,"path":295,"stem":296,"children":297},"Forms","\u002Fmodules\u002Ffeatures\u002Fforms","3.modules\u002F3.features\u002F2.forms\u002Findex",[298,299,303,306,309],{"title":173,"path":295,"stem":296},{"title":300,"path":301,"stem":302},"Definition","\u002Fmodules\u002Ffeatures\u002Fforms\u002Fdefinition","3.modules\u002F3.features\u002F2.forms\u002F2.definition",{"title":175,"path":304,"stem":305},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fserver","3.modules\u002F3.features\u002F2.forms\u002F3.server",{"title":267,"path":307,"stem":308},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fapp","3.modules\u002F3.features\u002F2.forms\u002F4.app",{"title":179,"path":310,"stem":311},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Freference","3.modules\u002F3.features\u002F2.forms\u002F5.reference",{"title":313,"path":314,"stem":315},"Cookie Consent","\u002Fmodules\u002Ffeatures\u002Fcookie-consent","3.modules\u002F3.features\u002F3.cookie-consent",{"title":317,"path":318,"stem":319},"MCP","\u002Fmodules\u002Ffeatures\u002Fmcp","3.modules\u002F3.features\u002F4.mcp",{"title":321,"icon":49,"path":322,"stem":323,"children":324,"page":49},"Interface","\u002Fmodules\u002Finterface","3.modules\u002F4.interface",[325,350,353,357,361],{"title":326,"path":327,"stem":328,"children":329},"UI","\u002Fmodules\u002Finterface\u002Fui","3.modules\u002F4.interface\u002F1.ui\u002Findex",[330,331,335,339,343,347],{"title":173,"path":327,"stem":328},{"title":332,"path":333,"stem":334},"Page components","\u002Fmodules\u002Finterface\u002Fui\u002Fpage-components","3.modules\u002F4.interface\u002F1.ui\u002F2.page-components",{"title":336,"path":337,"stem":338},"App shell","\u002Fmodules\u002Finterface\u002Fui\u002Fapp-shell","3.modules\u002F4.interface\u002F1.ui\u002F3.app-shell",{"title":340,"path":341,"stem":342},"Form inputs","\u002Fmodules\u002Finterface\u002Fui\u002Fform-inputs","3.modules\u002F4.interface\u002F1.ui\u002F4.form-inputs",{"title":344,"path":345,"stem":346},"Composables and helpers","\u002Fmodules\u002Finterface\u002Fui\u002Fcomposables","3.modules\u002F4.interface\u002F1.ui\u002F5.composables",{"title":179,"path":348,"stem":349},"\u002Fmodules\u002Finterface\u002Fui\u002Freference","3.modules\u002F4.interface\u002F1.ui\u002F6.reference",{"title":217,"path":351,"stem":352},"\u002Fmodules\u002Finterface\u002Fadmin","3.modules\u002F4.interface\u002F2.admin",{"title":354,"path":355,"stem":356},"Menu","\u002Fmodules\u002Finterface\u002Fmenu","3.modules\u002F4.interface\u002F3.menu",{"title":358,"path":359,"stem":360},"Widget","\u002Fmodules\u002Finterface\u002Fwidget","3.modules\u002F4.interface\u002F4.widget",{"title":362,"path":363,"stem":364,"children":365},"Mobile","\u002Fmodules\u002Finterface\u002Fmobile","3.modules\u002F4.interface\u002F5.mobile\u002Findex",[366,367,371],{"title":173,"path":363,"stem":364},{"title":368,"path":369,"stem":370},"CLI and devices","\u002Fmodules\u002Finterface\u002Fmobile\u002Fcli-and-devices","3.modules\u002F4.interface\u002F5.mobile\u002F2.cli-and-devices",{"title":372,"path":373,"stem":374},"Splash screen","\u002Fmodules\u002Finterface\u002Fmobile\u002Fsplash-screen","3.modules\u002F4.interface\u002F5.mobile\u002F3.splash-screen",{"title":376,"icon":49,"path":377,"stem":378,"children":379,"page":49},"Platform","\u002Fmodules\u002Fplatform","3.modules\u002F5.platform",[380,402,406,423],{"title":381,"path":382,"stem":383,"children":384},"Module Kit","\u002Fmodules\u002Fplatform\u002Fmodule-kit","3.modules\u002F5.platform\u002F1.module-kit\u002Findex",[385,386,390,394,398],{"title":173,"path":382,"stem":383},{"title":387,"path":388,"stem":389},"Server toolkit","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fserver-toolkit","3.modules\u002F5.platform\u002F1.module-kit\u002F2.server-toolkit",{"title":391,"path":392,"stem":393},"Registries and menus","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fregistries-and-menus","3.modules\u002F5.platform\u002F1.module-kit\u002F3.registries-and-menus",{"title":395,"path":396,"stem":397},"Translations","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fi18n","3.modules\u002F5.platform\u002F1.module-kit\u002F4.i18n",{"title":399,"path":400,"stem":401},"Database helpers","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fdatabase","3.modules\u002F5.platform\u002F1.module-kit\u002F5.database",{"title":403,"path":404,"stem":405},"Notify","\u002Fmodules\u002Fplatform\u002Fnotify","3.modules\u002F5.platform\u002F2.notify",{"title":407,"path":408,"stem":409,"children":410},"Email Templates","\u002Fmodules\u002Fplatform\u002Femail-templates","3.modules\u002F5.platform\u002F3.email-templates\u002Findex",[411,412,416,419],{"title":173,"path":408,"stem":409},{"title":413,"path":414,"stem":415},"Email components","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fcomponents","3.modules\u002F5.platform\u002F3.email-templates\u002F2.components",{"title":175,"path":417,"stem":418},"\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fserver","3.modules\u002F5.platform\u002F3.email-templates\u002F3.server",{"title":420,"path":421,"stem":422},"Module emails","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fmodule-emails","3.modules\u002F5.platform\u002F3.email-templates\u002F4.module-emails",{"title":424,"path":425,"stem":426,"children":427},"Base Layer","\u002Fmodules\u002Fplatform\u002Fbase-layer","3.modules\u002F5.platform\u002F4.base-layer\u002Findex",[428,429,433,437],{"title":173,"path":425,"stem":426},{"title":430,"path":431,"stem":432},"Content collections","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcontent-collections","3.modules\u002F5.platform\u002F4.base-layer\u002F2.content-collections",{"title":434,"path":435,"stem":436},"Layouts and routing","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Flayouts-and-routing","3.modules\u002F5.platform\u002F4.base-layer\u002F3.layouts-and-routing",{"title":438,"path":439,"stem":440},"Composables and utils","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcomposables-and-utils","3.modules\u002F5.platform\u002F4.base-layer\u002F4.composables-and-utils",{"title":442,"icon":443,"path":444,"stem":445,"children":446,"page":49},"Examples","i-lucide-code-xml","\u002Fexamples","4.examples",[447,466,476],{"title":448,"icon":49,"path":449,"stem":450,"children":451,"page":49},"Starters","\u002Fexamples\u002Fstarters","4.examples\u002F1.starters",[452,456,461],{"title":453,"path":454,"stem":455,"icon":6},"Workspace starter","\u002Fexamples\u002Fstarters\u002Fworkspace","4.examples\u002F1.starters\u002F1.workspace",{"title":457,"path":458,"stem":459,"icon":460},"Mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile","4.examples\u002F1.starters\u002F2.mobile","i-lucide-smartphone",{"title":462,"path":463,"stem":464,"icon":465},"Standalone mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile-standalone","4.examples\u002F1.starters\u002F3.mobile-standalone","i-lucide-tablet-smartphone",{"title":467,"icon":49,"path":468,"stem":469,"children":470,"page":49},"Apps","\u002Fexamples\u002Fapps","4.examples\u002F2.apps",[471],{"title":472,"path":473,"stem":474,"icon":475},"Frigear website app","\u002Fexamples\u002Fapps\u002Ffrigear-nu-website","4.examples\u002F2.apps\u002F1.frigear-nu-website","i-lucide-layout-dashboard",{"title":477,"icon":49,"path":478,"stem":479,"children":480,"page":49},"Tasks","\u002Fexamples\u002Ftasks","4.examples\u002F3.tasks",[481,485,489,494,499],{"title":482,"path":483,"stem":484,"icon":70},"Protect a route","\u002Fexamples\u002Ftasks\u002Fprotect-a-route","4.examples\u002F3.tasks\u002F1.protect-a-route",{"title":486,"path":487,"stem":488,"icon":475},"Add an admin page","\u002Fexamples\u002Ftasks\u002Fadd-an-admin-page","4.examples\u002F3.tasks\u002F2.add-an-admin-page",{"title":490,"path":491,"stem":492,"icon":493},"Sell event tickets","\u002Fexamples\u002Ftasks\u002Fsell-event-tickets","4.examples\u002F3.tasks\u002F3.sell-event-tickets","i-lucide-ticket",{"title":495,"path":496,"stem":497,"icon":498},"Build a form","\u002Fexamples\u002Ftasks\u002Fbuild-a-form","4.examples\u002F3.tasks\u002F4.build-a-form","i-lucide-clipboard-list",{"title":500,"path":501,"stem":502,"icon":503},"Send an email","\u002Fexamples\u002Ftasks\u002Fsend-an-email","4.examples\u002F3.tasks\u002F5.send-an-email","i-lucide-mail",{"title":505,"icon":506,"path":507,"stem":508,"children":509,"page":49},"Contribute","i-lucide-git-pull-request","\u002Fcontribute","5.contribute",[510,513,518,544,549,552,556,571],{"title":173,"path":511,"stem":512,"icon":506},"\u002Fcontribute\u002Foverview","5.contribute\u002F1.overview",{"title":514,"path":515,"stem":516,"icon":517},"Local development","\u002Fcontribute\u002Flocal-development","5.contribute\u002F2.local-development","i-lucide-terminal",{"title":519,"icon":49,"path":520,"stem":521,"children":522,"page":49},"Writing a module","\u002Fcontribute\u002Fwriting-a-module","5.contribute\u002F3.writing-a-module",[523,527,532,536,541],{"title":524,"path":525,"stem":526,"icon":39},"Scaffold a module","\u002Fcontribute\u002Fwriting-a-module\u002Fscaffold","5.contribute\u002F3.writing-a-module\u002F1.scaffold",{"title":528,"path":529,"stem":530,"icon":531},"Setup checklist","\u002Fcontribute\u002Fwriting-a-module\u002Fsetup-checklist","5.contribute\u002F3.writing-a-module\u002F2.setup-checklist","i-lucide-list-checks",{"title":533,"path":534,"stem":535,"icon":44},"Database tables","\u002Fcontribute\u002Fwriting-a-module\u002Fdatabase-tables","5.contribute\u002F3.writing-a-module\u002F3.database-tables",{"title":537,"path":538,"stem":539,"icon":540},"Testing","\u002Fcontribute\u002Fwriting-a-module\u002Ftesting","5.contribute\u002F3.writing-a-module\u002F4.testing","i-lucide-flask-conical",{"title":67,"path":542,"stem":543,"icon":70},"\u002Fcontribute\u002Fwriting-a-module\u002Faccess-control","5.contribute\u002F3.writing-a-module\u002F5.access-control",{"title":545,"path":546,"stem":547,"icon":548},"Publishing","\u002Fcontribute\u002Fpublishing","5.contribute\u002F4.publishing","i-lucide-package-check",{"title":448,"path":550,"stem":551,"icon":6},"\u002Fcontribute\u002Fstarters","5.contribute\u002F5.starters",{"title":553,"path":554,"stem":555,"icon":52},"Documentation","\u002Fcontribute\u002Fdocumentation","5.contribute\u002F6.documentation",{"title":557,"icon":49,"path":558,"stem":559,"children":560,"page":49},"Tooling","\u002Fcontribute\u002Ftooling","5.contribute\u002F7.tooling",[561,566],{"title":562,"path":563,"stem":564,"icon":565},"CLI","\u002Fcontribute\u002Ftooling\u002Fcli","5.contribute\u002F7.tooling\u002F1.cli","i-lucide-square-terminal",{"title":567,"path":568,"stem":569,"icon":570},"ESLint config","\u002Fcontribute\u002Ftooling\u002Feslint-config","5.contribute\u002F7.tooling\u002F2.eslint-config","i-lucide-spell-check",{"title":572,"icon":49,"path":573,"stem":574,"children":575},"Decisions","\u002Fcontribute\u002Fdecisions","5.contribute\u002F8.decisions\u002Findex",[576,578,583],{"title":572,"path":573,"stem":574,"icon":577},"i-lucide-scale",{"title":579,"path":580,"stem":581,"icon":582},"Session lifetimes per OAuth client","\u002Fcontribute\u002Fdecisions\u002Foauth-token-lifetimes","5.contribute\u002F8.decisions\u002F1.oauth-token-lifetimes","i-lucide-timer",{"title":584,"path":585,"stem":586,"icon":70},"One permission model","\u002Fcontribute\u002Fdecisions\u002Fpermission-model","5.contribute\u002F8.decisions\u002F2.permission-model",{"id":588,"title":589,"body":590,"description":2411,"extension":2412,"links":2413,"meta":2414,"navigation":2415,"path":235,"seo":2416,"stem":236,"__hash__":2417},"docs\u002F3.modules\u002F1.identity\u002F6.oauth-server\u002F3.hooks.md","OAuth Server hooks",{"type":591,"value":592,"toc":2402},"minimark",[593,605,609,617,706,726,729,1228,1232,1238,1255,1372,1381,1398,1404,1408,1443,1515,1522,1526,1538,1579,1941,1947,1951,1971,2297,2301,2304,2358,2364,2368,2398],[594,595,596,597,601,602,604],"p",{},"OAuth Server has no role model or staff list of its own. Who may manage applications, and which roles may sign in to which\napplication, come from the ",[598,599,600],"a",{"href":68},"permissions and roles"," of Auth and Authorization. What is left\nfor you to answer is what goes into a token, extra vetoes and audit logging. This page is for app developers, in server\nmode only. Set up the module first: ",[598,603,173],{"href":226},".",[606,607,234],"h2",{"id":608},"hooks",[594,610,611,612,616],{},"Your app answers these Nitro hooks from a server plugin (",[613,614,615],"code",{},"server\u002Fplugins\u002F*.ts",").",[618,619,620,636],"table",{},[621,622,623],"thead",{},[624,625,626,630,633],"tr",{},[627,628,629],"th",{},"Hook",[627,631,632],{},"When it runs",[627,634,635],{},"What your listener does",[637,638,639,665,681,694],"tbody",{},[624,640,641,647,654],{},[642,643,644],"td",{},[613,645,646],{},"oauth:application:access",[642,648,649,650,653],{},"After the ",[613,651,652],{},"allowedRoles"," check passed.",[642,655,656,657,660,661,664],{},"Sets ",[613,658,659],{},"allowed = false",", and optionally ",[613,662,663],{},"reason",", to refuse.",[624,666,667,672,675],{},[642,668,669],{},[613,670,671],{},"oauth:claims",[642,673,674],{},"An ID token, an access token or a userinfo response is built.",[642,676,677,678,604],{},"Changes ",[613,679,680],{},"claims",[624,682,683,688,691],{},[642,684,685],{},[613,686,687],{},"oauth:token:issued",[642,689,690],{},"Tokens were issued, at a code exchange or a refresh.",[642,692,693],{},"Logs or audits.",[624,695,696,701,704],{},[642,697,698],{},[613,699,700],{},"oauth:token:revoked",[642,702,703],{},"A refresh token family was revoked.",[642,705,693],{},[707,708,709,710,713,714,717,718,721,722,725],"warning",{},"Identify the user from ",[613,711,712],{},"ctx.user"," or ",[613,715,716],{},"ctx.userId",", never from the session on ",[613,719,720],{},"ctx.event",". The session is empty for requests\nthat carry a token, and ",[613,723,724],{},"event"," is missing for background calls.",[594,727,728],{},"Each hook receives one context object:",[730,731,736],"pre",{"className":732,"code":733,"language":734,"meta":735,"style":735},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","type ApplicationAccessContext = {\n  event?: H3Event \u002F\u002F undefined for background calls such as listUserApplications(userId)\n  user: OAuthUser\n  application: OAuthApplication\n  roles: string[] \u002F\u002F the user's effective roles\n  allowed: boolean \u002F\u002F true when the role check passed\n  reason?: string \u002F\u002F shown to the user as the 403 message\n}\n\ntype ClaimsContext = {\n  user: OAuthUser\n  application: OAuthApplication\n  scope: string[] \u002F\u002F granted scopes\n  roles: string[] \u002F\u002F effective roles\n  tokenType: 'id_token' | 'access_token' | 'userinfo'\n  claims: Record\u003Cstring, unknown> \u002F\u002F registered claims are re-applied afterwards\n}\n\ntype TokenIssuedContext = { userId: number, applicationId: string, scope: string[], grant: 'authorization_code' | 'refresh_token' }\ntype TokenRevokedContext = {\n  applicationId: string\n  userId: number | null\n  reason: 'revoked' | 'reuse_detected' | 'user_grants_revoked' | 'signed_out' | 'credentials_changed'\n}\n\ntype OAuthUser = { id: number, name: string, email: string, avatar: string | null } & Record\u003Cstring, unknown>\n","ts","",[613,737,738,758,775,787,798,816,830,843,849,856,868,877,886,901,915,953,982,987,992,1060,1072,1083,1098,1148,1153,1158],{"__ignoreMap":735},[739,740,743,747,751,755],"span",{"class":741,"line":742},"line",1,[739,744,746],{"class":745},"spNyl","type",[739,748,750],{"class":749},"sBMFI"," ApplicationAccessContext",[739,752,754],{"class":753},"sMK4o"," =",[739,756,757],{"class":753}," {\n",[739,759,761,765,768,771],{"class":741,"line":760},2,[739,762,764],{"class":763},"swJcz","  event",[739,766,767],{"class":753},"?:",[739,769,770],{"class":749}," H3Event",[739,772,774],{"class":773},"sHwdD"," \u002F\u002F undefined for background calls such as listUserApplications(userId)\n",[739,776,778,781,784],{"class":741,"line":777},3,[739,779,780],{"class":763},"  user",[739,782,783],{"class":753},":",[739,785,786],{"class":749}," OAuthUser\n",[739,788,790,793,795],{"class":741,"line":789},4,[739,791,792],{"class":763},"  application",[739,794,783],{"class":753},[739,796,797],{"class":749}," OAuthApplication\n",[739,799,801,804,806,809,813],{"class":741,"line":800},5,[739,802,803],{"class":763},"  roles",[739,805,783],{"class":753},[739,807,808],{"class":749}," string",[739,810,812],{"class":811},"sTEyZ","[] ",[739,814,815],{"class":773},"\u002F\u002F the user's effective roles\n",[739,817,819,822,824,827],{"class":741,"line":818},6,[739,820,821],{"class":763},"  allowed",[739,823,783],{"class":753},[739,825,826],{"class":749}," boolean",[739,828,829],{"class":773}," \u002F\u002F true when the role check passed\n",[739,831,833,836,838,840],{"class":741,"line":832},7,[739,834,835],{"class":763},"  reason",[739,837,767],{"class":753},[739,839,808],{"class":749},[739,841,842],{"class":773}," \u002F\u002F shown to the user as the 403 message\n",[739,844,846],{"class":741,"line":845},8,[739,847,848],{"class":753},"}\n",[739,850,852],{"class":741,"line":851},9,[739,853,855],{"emptyLinePlaceholder":854},true,"\n",[739,857,859,861,864,866],{"class":741,"line":858},10,[739,860,746],{"class":745},[739,862,863],{"class":749}," ClaimsContext",[739,865,754],{"class":753},[739,867,757],{"class":753},[739,869,871,873,875],{"class":741,"line":870},11,[739,872,780],{"class":763},[739,874,783],{"class":753},[739,876,786],{"class":749},[739,878,880,882,884],{"class":741,"line":879},12,[739,881,792],{"class":763},[739,883,783],{"class":753},[739,885,797],{"class":749},[739,887,889,892,894,896,898],{"class":741,"line":888},13,[739,890,891],{"class":763},"  scope",[739,893,783],{"class":753},[739,895,808],{"class":749},[739,897,812],{"class":811},[739,899,900],{"class":773},"\u002F\u002F granted scopes\n",[739,902,904,906,908,910,912],{"class":741,"line":903},14,[739,905,803],{"class":763},[739,907,783],{"class":753},[739,909,808],{"class":749},[739,911,812],{"class":811},[739,913,914],{"class":773},"\u002F\u002F effective roles\n",[739,916,918,921,923,926,930,933,936,938,941,943,945,947,950],{"class":741,"line":917},15,[739,919,920],{"class":763},"  tokenType",[739,922,783],{"class":753},[739,924,925],{"class":753}," '",[739,927,929],{"class":928},"sfazB","id_token",[739,931,932],{"class":753},"'",[739,934,935],{"class":753}," |",[739,937,925],{"class":753},[739,939,940],{"class":928},"access_token",[739,942,932],{"class":753},[739,944,935],{"class":753},[739,946,925],{"class":753},[739,948,949],{"class":928},"userinfo",[739,951,952],{"class":753},"'\n",[739,954,956,959,961,964,967,970,973,976,979],{"class":741,"line":955},16,[739,957,958],{"class":763},"  claims",[739,960,783],{"class":753},[739,962,963],{"class":749}," Record",[739,965,966],{"class":753},"\u003C",[739,968,969],{"class":749},"string",[739,971,972],{"class":753},",",[739,974,975],{"class":749}," unknown",[739,977,978],{"class":753},">",[739,980,981],{"class":773}," \u002F\u002F registered claims are re-applied afterwards\n",[739,983,985],{"class":741,"line":984},17,[739,986,848],{"class":753},[739,988,990],{"class":741,"line":989},18,[739,991,855],{"emptyLinePlaceholder":854},[739,993,995,997,1000,1002,1005,1008,1010,1013,1015,1018,1020,1022,1024,1027,1029,1031,1034,1036,1039,1041,1043,1046,1048,1050,1052,1055,1057],{"class":741,"line":994},19,[739,996,746],{"class":745},[739,998,999],{"class":749}," TokenIssuedContext",[739,1001,754],{"class":753},[739,1003,1004],{"class":753}," {",[739,1006,1007],{"class":763}," userId",[739,1009,783],{"class":753},[739,1011,1012],{"class":749}," number",[739,1014,972],{"class":753},[739,1016,1017],{"class":763}," applicationId",[739,1019,783],{"class":753},[739,1021,808],{"class":749},[739,1023,972],{"class":753},[739,1025,1026],{"class":763}," scope",[739,1028,783],{"class":753},[739,1030,808],{"class":749},[739,1032,1033],{"class":811},"[]",[739,1035,972],{"class":753},[739,1037,1038],{"class":763}," grant",[739,1040,783],{"class":753},[739,1042,925],{"class":753},[739,1044,1045],{"class":928},"authorization_code",[739,1047,932],{"class":753},[739,1049,935],{"class":753},[739,1051,925],{"class":753},[739,1053,1054],{"class":928},"refresh_token",[739,1056,932],{"class":753},[739,1058,1059],{"class":753}," }\n",[739,1061,1063,1065,1068,1070],{"class":741,"line":1062},20,[739,1064,746],{"class":745},[739,1066,1067],{"class":749}," TokenRevokedContext",[739,1069,754],{"class":753},[739,1071,757],{"class":753},[739,1073,1075,1078,1080],{"class":741,"line":1074},21,[739,1076,1077],{"class":763},"  applicationId",[739,1079,783],{"class":753},[739,1081,1082],{"class":749}," string\n",[739,1084,1086,1089,1091,1093,1095],{"class":741,"line":1085},22,[739,1087,1088],{"class":763},"  userId",[739,1090,783],{"class":753},[739,1092,1012],{"class":749},[739,1094,935],{"class":753},[739,1096,1097],{"class":749}," null\n",[739,1099,1101,1103,1105,1107,1110,1112,1114,1116,1119,1121,1123,1125,1128,1130,1132,1134,1137,1139,1141,1143,1146],{"class":741,"line":1100},23,[739,1102,835],{"class":763},[739,1104,783],{"class":753},[739,1106,925],{"class":753},[739,1108,1109],{"class":928},"revoked",[739,1111,932],{"class":753},[739,1113,935],{"class":753},[739,1115,925],{"class":753},[739,1117,1118],{"class":928},"reuse_detected",[739,1120,932],{"class":753},[739,1122,935],{"class":753},[739,1124,925],{"class":753},[739,1126,1127],{"class":928},"user_grants_revoked",[739,1129,932],{"class":753},[739,1131,935],{"class":753},[739,1133,925],{"class":753},[739,1135,1136],{"class":928},"signed_out",[739,1138,932],{"class":753},[739,1140,935],{"class":753},[739,1142,925],{"class":753},[739,1144,1145],{"class":928},"credentials_changed",[739,1147,952],{"class":753},[739,1149,1151],{"class":741,"line":1150},24,[739,1152,848],{"class":753},[739,1154,1156],{"class":741,"line":1155},25,[739,1157,855],{"emptyLinePlaceholder":854},[739,1159,1161,1163,1166,1168,1170,1173,1175,1177,1179,1182,1184,1186,1188,1191,1193,1195,1197,1200,1202,1204,1206,1209,1212,1215,1217,1219,1221,1223,1225],{"class":741,"line":1160},26,[739,1162,746],{"class":745},[739,1164,1165],{"class":749}," OAuthUser",[739,1167,754],{"class":753},[739,1169,1004],{"class":753},[739,1171,1172],{"class":763}," id",[739,1174,783],{"class":753},[739,1176,1012],{"class":749},[739,1178,972],{"class":753},[739,1180,1181],{"class":763}," name",[739,1183,783],{"class":753},[739,1185,808],{"class":749},[739,1187,972],{"class":753},[739,1189,1190],{"class":763}," email",[739,1192,783],{"class":753},[739,1194,808],{"class":749},[739,1196,972],{"class":753},[739,1198,1199],{"class":763}," avatar",[739,1201,783],{"class":753},[739,1203,808],{"class":749},[739,1205,935],{"class":753},[739,1207,1208],{"class":749}," null",[739,1210,1211],{"class":753}," }",[739,1213,1214],{"class":753}," &",[739,1216,963],{"class":749},[739,1218,966],{"class":753},[739,1220,969],{"class":749},[739,1222,972],{"class":753},[739,1224,975],{"class":749},[739,1226,1227],{"class":753},">\n",[606,1229,1231],{"id":1230},"who-may-sign-in-to-an-application","Who may sign in to an application",[594,1233,1234,1235,1237],{},"Each OAuth application lists the roles that may sign in to it, in ",[613,1236,652],{},". A user may sign in when they hold at\nleast one of them. An empty list lets every signed-in user in.",[594,1239,1240,1241,1244,1245,1248,1249,1252,1253,604],{},"The roles are the user's ",[598,1242,1243],{"href":206},"effective roles",": the roles assigned to\nthem, the default and ",[613,1246,1247],{},"auto"," roles, and everything those roles inherit. Authorization resolves them, so you write no hook.\nA role that inherits ",[613,1250,1251],{},"member"," therefore passes an application that lists ",[613,1254,1251],{},[730,1256,1259],{"className":732,"code":1257,"filename":1258,"language":734,"meta":735,"style":735},"oauthServer: {\n  clients: [{\n    id: 'mobile',\n    name: 'Example mobile',\n    redirectUris: ['com.example.app:\u002Fauth\u002Fcallback'],\n    allowedRoles: ['member'], \u002F\u002F admins inherit `member`, so they pass too\n  }],\n}\n","nuxt.config.ts",[613,1260,1261,1270,1283,1300,1316,1337,1359,1368],{"__ignoreMap":735},[739,1262,1263,1266,1268],{"class":741,"line":742},[739,1264,1265],{"class":749},"oauthServer",[739,1267,783],{"class":753},[739,1269,757],{"class":753},[739,1271,1272,1275,1277,1280],{"class":741,"line":760},[739,1273,1274],{"class":749},"  clients",[739,1276,783],{"class":753},[739,1278,1279],{"class":763}," [",[739,1281,1282],{"class":753},"{\n",[739,1284,1285,1288,1290,1292,1295,1297],{"class":741,"line":777},[739,1286,1287],{"class":763},"    id",[739,1289,783],{"class":753},[739,1291,925],{"class":753},[739,1293,1294],{"class":928},"mobile",[739,1296,932],{"class":753},[739,1298,1299],{"class":753},",\n",[739,1301,1302,1305,1307,1309,1312,1314],{"class":741,"line":789},[739,1303,1304],{"class":763},"    name",[739,1306,783],{"class":753},[739,1308,925],{"class":753},[739,1310,1311],{"class":928},"Example mobile",[739,1313,932],{"class":753},[739,1315,1299],{"class":753},[739,1317,1318,1321,1323,1325,1327,1330,1332,1335],{"class":741,"line":800},[739,1319,1320],{"class":763},"    redirectUris",[739,1322,783],{"class":753},[739,1324,1279],{"class":763},[739,1326,932],{"class":753},[739,1328,1329],{"class":928},"com.example.app:\u002Fauth\u002Fcallback",[739,1331,932],{"class":753},[739,1333,1334],{"class":763},"]",[739,1336,1299],{"class":753},[739,1338,1339,1342,1344,1346,1348,1350,1352,1354,1356],{"class":741,"line":818},[739,1340,1341],{"class":763},"    allowedRoles",[739,1343,783],{"class":753},[739,1345,1279],{"class":763},[739,1347,932],{"class":753},[739,1349,1251],{"class":928},[739,1351,932],{"class":753},[739,1353,1334],{"class":763},[739,1355,972],{"class":753},[739,1357,1358],{"class":773}," \u002F\u002F admins inherit `member`, so they pass too\n",[739,1360,1361,1364,1366],{"class":741,"line":832},[739,1362,1363],{"class":753},"  }",[739,1365,1334],{"class":763},[739,1367,1299],{"class":753},[739,1369,1370],{"class":741,"line":845},[739,1371,848],{"class":753},[707,1373,1374,1375,1377,1378,1380],{},"An application with a non-empty ",[613,1376,652],{}," locks out everybody who holds none of them. Without\n",[598,1379,199],{"href":200}," nobody holds any role.",[594,1382,1383,1384,1386,1387,1391,1392,1397],{},"To decide from other data, such as a suspended account, use the ",[613,1385,646],{}," hook\n(",[598,1388,1390],{"href":1389},"#vetoing-access-and-auditing","below","). To give a user a role from data you already have, such as an email allowlist, add\nit through the ",[598,1393,1394],{"href":206},[613,1395,1396],{},"authorization:roles"," hook of Authorization.",[594,1399,1400,1401,1403],{},"Roles are checked at the authorization request, on the consent page, on approval, at every token exchange and on\n",[613,1402,949],{},". So a user who loses a role is stopped at the next refresh.",[606,1405,1407],{"id":1406},"who-is-an-admin","Who is an admin",[594,1409,1410,1411,1414,1415,1418,1419,1422,1423,1426,1427,1430,1431,1434,1435,1438,1439,1442],{},"The staff routes that manage applications and scopes call ",[613,1412,1413],{},"requireOAuthAdmin(event)",". It answers ",[613,1416,1417],{},"401"," when nobody is\nsigned in. It answers ",[613,1420,1421],{},"403 forbidden"," unless the user holds the ",[613,1424,1425],{},"oauth:manage"," ",[598,1428,1429],{"href":200},"permission",",\nand ",[613,1432,1433],{},"403 session_required"," for a bearer token, since the permission is ",[613,1436,1437],{},"sessionOnly",". The ",[613,1440,1441],{},"admin"," role is given it by\ndefault. To let another role in, grant it:",[730,1444,1446],{"className":732,"code":1445,"filename":1258,"language":734,"meta":735,"style":735},"authorization: {\n  roles: {\n    integrations: { label: 'Integrations', grant: ['oauth:manage'] },\n  },\n},\n",[613,1447,1448,1457,1465,1506,1511],{"__ignoreMap":735},[739,1449,1450,1453,1455],{"class":741,"line":742},[739,1451,1452],{"class":749},"authorization",[739,1454,783],{"class":753},[739,1456,757],{"class":753},[739,1458,1459,1461,1463],{"class":741,"line":760},[739,1460,803],{"class":749},[739,1462,783],{"class":753},[739,1464,757],{"class":753},[739,1466,1467,1470,1472,1474,1477,1479,1481,1484,1486,1488,1490,1492,1494,1496,1498,1500,1503],{"class":741,"line":777},[739,1468,1469],{"class":749},"    integrations",[739,1471,783],{"class":753},[739,1473,1004],{"class":753},[739,1475,1476],{"class":749}," label",[739,1478,783],{"class":753},[739,1480,925],{"class":753},[739,1482,1483],{"class":928},"Integrations",[739,1485,932],{"class":753},[739,1487,972],{"class":753},[739,1489,1038],{"class":749},[739,1491,783],{"class":753},[739,1493,1279],{"class":763},[739,1495,932],{"class":753},[739,1497,1425],{"class":928},[739,1499,932],{"class":753},[739,1501,1502],{"class":763},"] ",[739,1504,1505],{"class":753},"},\n",[739,1507,1508],{"class":741,"line":789},[739,1509,1510],{"class":753},"  },\n",[739,1512,1513],{"class":741,"line":800},[739,1514,1505],{"class":753},[594,1516,1517,1518,1521],{},"Every user also holds ",[613,1519,1520],{},"oauth:read",", which lets them see the applications they may sign in to.",[606,1523,1525],{"id":1524},"enriching-tokens-and-userinfo","Enriching tokens and userinfo",[594,1527,1528,1530,1531,1533,1534,1537],{},[613,1529,671],{}," runs for every token and for ",[613,1532,949],{},". Use it to add a role, a custom scope's data or a per-application\nvalue. When it runs, the module has already added the standard profile claims for the granted scopes. The ",[613,1535,1536],{},"permissions","\nclaim of an access token comes from the granted scopes, not from this hook.",[1539,1540,1541,1542,1545,1546,1299,1549,1545,1552,1545,1555,1545,1558,1545,1561,1545,1564,1545,1567,1545,1570,1545,1573,1576,1577,604],"note",{},"The registered claims are applied again after your listener, so you cannot overwrite them. They are ",[613,1543,1544],{},"iss",", ",[613,1547,1548],{},"sub",[613,1550,1551],{},"aud",[613,1553,1554],{},"exp",[613,1556,1557],{},"iat",[613,1559,1560],{},"nbf",[613,1562,1563],{},"jti",[613,1565,1566],{},"nonce",[613,1568,1569],{},"auth_time",[613,1571,1572],{},"scope",[613,1574,1575],{},"client_id"," and ",[613,1578,1536],{},[730,1580,1582],{"className":732,"code":1581,"language":734,"meta":735,"style":735},"export default defineNitroPlugin((nitro) => {\n  nitro.hooks.hook('oauth:claims', async (ctx) => {\n    \u002F\u002F Access tokens stay bare, so only the ID token and userinfo get identity claims.\n    if (ctx.tokenType === 'access_token') return\n\n    ctx.claims['https:\u002F\u002Ffrigear.nu\u002Fclaims\u002Frole'] = ctx.roles[0] ?? 'user'\n\n    \u002F\u002F A custom scope: list it in `oauthServer.scopes: ['groups']`, applications then request `scope=openid groups`\n    if (ctx.scope.includes('groups')) ctx.claims.groups = ctx.roles\n\n    \u002F\u002F Per application\n    if (ctx.application.tags.includes('shop')) ctx.claims.customer_id = await customerIdFor(ctx.user.id)\n\n    \u002F\u002F Remove something\n    if (!ctx.scope.includes('email')) delete ctx.claims.email\n  })\n})\n",[613,1583,1584,1614,1653,1658,1687,1691,1741,1745,1750,1798,1802,1807,1875,1879,1884,1928,1934],{"__ignoreMap":735},[739,1585,1586,1590,1593,1597,1600,1602,1606,1609,1612],{"class":741,"line":742},[739,1587,1589],{"class":1588},"s7zQu","export",[739,1591,1592],{"class":1588}," default",[739,1594,1596],{"class":1595},"s2Zo4"," defineNitroPlugin",[739,1598,1599],{"class":811},"(",[739,1601,1599],{"class":753},[739,1603,1605],{"class":1604},"sHdIc","nitro",[739,1607,1608],{"class":753},")",[739,1610,1611],{"class":745}," =>",[739,1613,757],{"class":753},[739,1615,1616,1619,1621,1623,1625,1628,1630,1632,1634,1636,1638,1641,1644,1647,1649,1651],{"class":741,"line":760},[739,1617,1618],{"class":811},"  nitro",[739,1620,604],{"class":753},[739,1622,608],{"class":811},[739,1624,604],{"class":753},[739,1626,1627],{"class":1595},"hook",[739,1629,1599],{"class":763},[739,1631,932],{"class":753},[739,1633,671],{"class":928},[739,1635,932],{"class":753},[739,1637,972],{"class":753},[739,1639,1640],{"class":745}," async",[739,1642,1643],{"class":753}," (",[739,1645,1646],{"class":1604},"ctx",[739,1648,1608],{"class":753},[739,1650,1611],{"class":745},[739,1652,757],{"class":753},[739,1654,1655],{"class":741,"line":777},[739,1656,1657],{"class":773},"    \u002F\u002F Access tokens stay bare, so only the ID token and userinfo get identity claims.\n",[739,1659,1660,1663,1665,1667,1669,1672,1675,1677,1679,1681,1684],{"class":741,"line":789},[739,1661,1662],{"class":1588},"    if",[739,1664,1643],{"class":763},[739,1666,1646],{"class":811},[739,1668,604],{"class":753},[739,1670,1671],{"class":811},"tokenType",[739,1673,1674],{"class":753}," ===",[739,1676,925],{"class":753},[739,1678,940],{"class":928},[739,1680,932],{"class":753},[739,1682,1683],{"class":763},") ",[739,1685,1686],{"class":1588},"return\n",[739,1688,1689],{"class":741,"line":800},[739,1690,855],{"emptyLinePlaceholder":854},[739,1692,1693,1696,1698,1700,1703,1705,1708,1710,1712,1715,1718,1720,1723,1725,1729,1731,1734,1736,1739],{"class":741,"line":818},[739,1694,1695],{"class":811},"    ctx",[739,1697,604],{"class":753},[739,1699,680],{"class":811},[739,1701,1702],{"class":763},"[",[739,1704,932],{"class":753},[739,1706,1707],{"class":928},"https:\u002F\u002Ffrigear.nu\u002Fclaims\u002Frole",[739,1709,932],{"class":753},[739,1711,1502],{"class":763},[739,1713,1714],{"class":753},"=",[739,1716,1717],{"class":811}," ctx",[739,1719,604],{"class":753},[739,1721,1722],{"class":811},"roles",[739,1724,1702],{"class":763},[739,1726,1728],{"class":1727},"sbssI","0",[739,1730,1502],{"class":763},[739,1732,1733],{"class":753},"??",[739,1735,925],{"class":753},[739,1737,1738],{"class":928},"user",[739,1740,952],{"class":753},[739,1742,1743],{"class":741,"line":832},[739,1744,855],{"emptyLinePlaceholder":854},[739,1746,1747],{"class":741,"line":845},[739,1748,1749],{"class":773},"    \u002F\u002F A custom scope: list it in `oauthServer.scopes: ['groups']`, applications then request `scope=openid groups`\n",[739,1751,1752,1754,1756,1758,1760,1762,1764,1767,1769,1771,1774,1776,1779,1781,1783,1785,1787,1789,1791,1793,1795],{"class":741,"line":851},[739,1753,1662],{"class":1588},[739,1755,1643],{"class":763},[739,1757,1646],{"class":811},[739,1759,604],{"class":753},[739,1761,1572],{"class":811},[739,1763,604],{"class":753},[739,1765,1766],{"class":1595},"includes",[739,1768,1599],{"class":763},[739,1770,932],{"class":753},[739,1772,1773],{"class":928},"groups",[739,1775,932],{"class":753},[739,1777,1778],{"class":763},")) ",[739,1780,1646],{"class":811},[739,1782,604],{"class":753},[739,1784,680],{"class":811},[739,1786,604],{"class":753},[739,1788,1773],{"class":811},[739,1790,754],{"class":753},[739,1792,1717],{"class":811},[739,1794,604],{"class":753},[739,1796,1797],{"class":811},"roles\n",[739,1799,1800],{"class":741,"line":858},[739,1801,855],{"emptyLinePlaceholder":854},[739,1803,1804],{"class":741,"line":870},[739,1805,1806],{"class":773},"    \u002F\u002F Per application\n",[739,1808,1809,1811,1813,1815,1817,1820,1822,1825,1827,1829,1831,1833,1836,1838,1840,1842,1844,1846,1848,1851,1853,1856,1859,1861,1863,1865,1867,1869,1872],{"class":741,"line":879},[739,1810,1662],{"class":1588},[739,1812,1643],{"class":763},[739,1814,1646],{"class":811},[739,1816,604],{"class":753},[739,1818,1819],{"class":811},"application",[739,1821,604],{"class":753},[739,1823,1824],{"class":811},"tags",[739,1826,604],{"class":753},[739,1828,1766],{"class":1595},[739,1830,1599],{"class":763},[739,1832,932],{"class":753},[739,1834,1835],{"class":928},"shop",[739,1837,932],{"class":753},[739,1839,1778],{"class":763},[739,1841,1646],{"class":811},[739,1843,604],{"class":753},[739,1845,680],{"class":811},[739,1847,604],{"class":753},[739,1849,1850],{"class":811},"customer_id",[739,1852,754],{"class":753},[739,1854,1855],{"class":1588}," await",[739,1857,1858],{"class":1595}," customerIdFor",[739,1860,1599],{"class":763},[739,1862,1646],{"class":811},[739,1864,604],{"class":753},[739,1866,1738],{"class":811},[739,1868,604],{"class":753},[739,1870,1871],{"class":811},"id",[739,1873,1874],{"class":763},")\n",[739,1876,1877],{"class":741,"line":888},[739,1878,855],{"emptyLinePlaceholder":854},[739,1880,1881],{"class":741,"line":903},[739,1882,1883],{"class":773},"    \u002F\u002F Remove something\n",[739,1885,1886,1888,1890,1893,1895,1897,1899,1901,1903,1905,1907,1910,1912,1914,1917,1919,1921,1923,1925],{"class":741,"line":917},[739,1887,1662],{"class":1588},[739,1889,1643],{"class":763},[739,1891,1892],{"class":753},"!",[739,1894,1646],{"class":811},[739,1896,604],{"class":753},[739,1898,1572],{"class":811},[739,1900,604],{"class":753},[739,1902,1766],{"class":1595},[739,1904,1599],{"class":763},[739,1906,932],{"class":753},[739,1908,1909],{"class":928},"email",[739,1911,932],{"class":753},[739,1913,1778],{"class":763},[739,1915,1916],{"class":753},"delete",[739,1918,1717],{"class":811},[739,1920,604],{"class":753},[739,1922,680],{"class":811},[739,1924,604],{"class":753},[739,1926,1927],{"class":811},"email\n",[739,1929,1930,1932],{"class":741,"line":955},[739,1931,1363],{"class":753},[739,1933,1874],{"class":763},[739,1935,1936,1939],{"class":741,"line":984},[739,1937,1938],{"class":753},"}",[739,1940,1874],{"class":811},[594,1942,1943,1946],{},[598,1944,221],{"href":1945},"\u002Fmodules\u002Fidentity\u002Fpreferences#oauth-claims"," uses this hook to forward user preferences as claims.",[606,1948,1950],{"id":1949},"vetoing-access-and-auditing","Vetoing access and auditing",[594,1952,1953,1955,1956,1958,1959,1961,1962,1965,1966,1576,1968,1970],{},[613,1954,646],{}," runs after the ",[613,1957,652],{}," check and can still refuse a user, for example a suspended account. Its\n",[613,1960,663],{}," is shown to the user as the ",[613,1963,1964],{},"403"," message. ",[613,1967,687],{},[613,1969,700],{}," only report, so use\nthem for audit logs.",[730,1972,1974],{"className":732,"code":1973,"language":734,"meta":735,"style":735},"export default defineNitroPlugin((nitro) => {\n  \u002F\u002F After the role check: e.g. only users with a verified email, or a suspended flag\n  nitro.hooks.hook('oauth:application:access', (ctx) => {\n    if (ctx.user.suspended) {\n      ctx.allowed = false\n      ctx.reason = 'Your account is suspended.'\n    }\n  })\n\n  nitro.hooks.hook('oauth:token:issued', ({ userId, applicationId, grant }) => {\n    console.info(`[oauth] tokens issued to user ${userId} for ${applicationId} (${grant})`)\n  })\n  nitro.hooks.hook('oauth:token:revoked', ({ applicationId, userId, reason }) => {\n    console.warn(`[oauth] revoked ${applicationId}\u002F${userId}: ${reason}`)\n  })\n})\n",[613,1975,1976,1996,2001,2033,2054,2070,2087,2092,2098,2102,2144,2195,2201,2242,2285,2291],{"__ignoreMap":735},[739,1977,1978,1980,1982,1984,1986,1988,1990,1992,1994],{"class":741,"line":742},[739,1979,1589],{"class":1588},[739,1981,1592],{"class":1588},[739,1983,1596],{"class":1595},[739,1985,1599],{"class":811},[739,1987,1599],{"class":753},[739,1989,1605],{"class":1604},[739,1991,1608],{"class":753},[739,1993,1611],{"class":745},[739,1995,757],{"class":753},[739,1997,1998],{"class":741,"line":760},[739,1999,2000],{"class":773},"  \u002F\u002F After the role check: e.g. only users with a verified email, or a suspended flag\n",[739,2002,2003,2005,2007,2009,2011,2013,2015,2017,2019,2021,2023,2025,2027,2029,2031],{"class":741,"line":777},[739,2004,1618],{"class":811},[739,2006,604],{"class":753},[739,2008,608],{"class":811},[739,2010,604],{"class":753},[739,2012,1627],{"class":1595},[739,2014,1599],{"class":763},[739,2016,932],{"class":753},[739,2018,646],{"class":928},[739,2020,932],{"class":753},[739,2022,972],{"class":753},[739,2024,1643],{"class":753},[739,2026,1646],{"class":1604},[739,2028,1608],{"class":753},[739,2030,1611],{"class":745},[739,2032,757],{"class":753},[739,2034,2035,2037,2039,2041,2043,2045,2047,2050,2052],{"class":741,"line":789},[739,2036,1662],{"class":1588},[739,2038,1643],{"class":763},[739,2040,1646],{"class":811},[739,2042,604],{"class":753},[739,2044,1738],{"class":811},[739,2046,604],{"class":753},[739,2048,2049],{"class":811},"suspended",[739,2051,1683],{"class":763},[739,2053,1282],{"class":753},[739,2055,2056,2059,2061,2064,2066],{"class":741,"line":800},[739,2057,2058],{"class":811},"      ctx",[739,2060,604],{"class":753},[739,2062,2063],{"class":811},"allowed",[739,2065,754],{"class":753},[739,2067,2069],{"class":2068},"sfNiH"," false\n",[739,2071,2072,2074,2076,2078,2080,2082,2085],{"class":741,"line":818},[739,2073,2058],{"class":811},[739,2075,604],{"class":753},[739,2077,663],{"class":811},[739,2079,754],{"class":753},[739,2081,925],{"class":753},[739,2083,2084],{"class":928},"Your account is suspended.",[739,2086,952],{"class":753},[739,2088,2089],{"class":741,"line":832},[739,2090,2091],{"class":753},"    }\n",[739,2093,2094,2096],{"class":741,"line":845},[739,2095,1363],{"class":753},[739,2097,1874],{"class":763},[739,2099,2100],{"class":741,"line":851},[739,2101,855],{"emptyLinePlaceholder":854},[739,2103,2104,2106,2108,2110,2112,2114,2116,2118,2120,2122,2124,2127,2129,2131,2133,2135,2137,2140,2142],{"class":741,"line":858},[739,2105,1618],{"class":811},[739,2107,604],{"class":753},[739,2109,608],{"class":811},[739,2111,604],{"class":753},[739,2113,1627],{"class":1595},[739,2115,1599],{"class":763},[739,2117,932],{"class":753},[739,2119,687],{"class":928},[739,2121,932],{"class":753},[739,2123,972],{"class":753},[739,2125,2126],{"class":753}," ({",[739,2128,1007],{"class":1604},[739,2130,972],{"class":753},[739,2132,1017],{"class":1604},[739,2134,972],{"class":753},[739,2136,1038],{"class":1604},[739,2138,2139],{"class":753}," })",[739,2141,1611],{"class":745},[739,2143,757],{"class":753},[739,2145,2146,2149,2151,2154,2156,2159,2162,2165,2168,2170,2173,2175,2178,2180,2182,2184,2187,2189,2191,2193],{"class":741,"line":870},[739,2147,2148],{"class":811},"    console",[739,2150,604],{"class":753},[739,2152,2153],{"class":1595},"info",[739,2155,1599],{"class":763},[739,2157,2158],{"class":753},"`",[739,2160,2161],{"class":928},"[oauth] tokens issued to user ",[739,2163,2164],{"class":753},"${",[739,2166,2167],{"class":811},"userId",[739,2169,1938],{"class":753},[739,2171,2172],{"class":928}," for ",[739,2174,2164],{"class":753},[739,2176,2177],{"class":811},"applicationId",[739,2179,1938],{"class":753},[739,2181,1643],{"class":928},[739,2183,2164],{"class":753},[739,2185,2186],{"class":811},"grant",[739,2188,1938],{"class":753},[739,2190,1608],{"class":928},[739,2192,2158],{"class":753},[739,2194,1874],{"class":763},[739,2196,2197,2199],{"class":741,"line":879},[739,2198,1363],{"class":753},[739,2200,1874],{"class":763},[739,2202,2203,2205,2207,2209,2211,2213,2215,2217,2219,2221,2223,2225,2227,2229,2231,2233,2236,2238,2240],{"class":741,"line":888},[739,2204,1618],{"class":811},[739,2206,604],{"class":753},[739,2208,608],{"class":811},[739,2210,604],{"class":753},[739,2212,1627],{"class":1595},[739,2214,1599],{"class":763},[739,2216,932],{"class":753},[739,2218,700],{"class":928},[739,2220,932],{"class":753},[739,2222,972],{"class":753},[739,2224,2126],{"class":753},[739,2226,1017],{"class":1604},[739,2228,972],{"class":753},[739,2230,1007],{"class":1604},[739,2232,972],{"class":753},[739,2234,2235],{"class":1604}," reason",[739,2237,2139],{"class":753},[739,2239,1611],{"class":745},[739,2241,757],{"class":753},[739,2243,2244,2246,2248,2251,2253,2255,2258,2260,2262,2264,2267,2269,2271,2273,2276,2278,2280,2283],{"class":741,"line":903},[739,2245,2148],{"class":811},[739,2247,604],{"class":753},[739,2249,2250],{"class":1595},"warn",[739,2252,1599],{"class":763},[739,2254,2158],{"class":753},[739,2256,2257],{"class":928},"[oauth] revoked ",[739,2259,2164],{"class":753},[739,2261,2177],{"class":811},[739,2263,1938],{"class":753},[739,2265,2266],{"class":928},"\u002F",[739,2268,2164],{"class":753},[739,2270,2167],{"class":811},[739,2272,1938],{"class":753},[739,2274,2275],{"class":928},": ",[739,2277,2164],{"class":753},[739,2279,663],{"class":811},[739,2281,2282],{"class":753},"}`",[739,2284,1874],{"class":763},[739,2286,2287,2289],{"class":741,"line":917},[739,2288,1363],{"class":753},[739,2290,1874],{"class":763},[739,2292,2293,2295],{"class":741,"line":955},[739,2294,1938],{"class":753},[739,2296,1874],{"class":811},[606,2298,2300],{"id":2299},"removed-hooks","Removed hooks",[594,2302,2303],{},"These hooks no longer exist. A listener for one is never called.",[618,2305,2306,2316],{},[621,2307,2308],{},[624,2309,2310,2313],{},[627,2311,2312],{},"Removed hook",[627,2314,2315],{},"Use instead",[637,2317,2318,2331,2344],{},[624,2319,2320,2325],{},[642,2321,2322],{},[613,2323,2324],{},"oauth:authorize",[642,2326,2327,2328,2330],{},"The ",[613,2329,1425],{}," permission, granted through roles.",[624,2332,2333,2338],{},[642,2334,2335],{},[613,2336,2337],{},"oauth:user:roles",[642,2339,2340,2341,2343],{},"Roles from Authorization. ",[613,2342,652],{}," match the effective roles.",[624,2345,2346,2351],{},[642,2347,2348],{},[613,2349,2350],{},"oauth:scope:staff",[642,2352,2353,2354,2357],{},"Give the permission a scope stands for only to the roles that should have it. ",[613,2355,2356],{},"staffOnly"," is gone too.",[594,2359,2360,2363],{},[598,2361,2362],{"href":152},"Migrate to the new access control"," walks through the move.",[606,2365,2367],{"id":2366},"next-steps","Next steps",[2369,2370,2371,2380,2387,2392],"ul",{},[2372,2373,2374,2376,2377,2379],"li",{},[598,2375,136],{"href":137}," – set ",[613,2378,652],{}," on your first\napplication.",[2372,2381,2382,2386],{},[598,2383,2385],{"href":2384},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fserver#scopes","Scopes"," – decide what applications may ask users for.",[2372,2388,2389,2391],{},[598,2390,221],{"href":1945}," – forward user preferences as claims without your own\nhook.",[2372,2393,2394,2397],{},[598,2395,2396],{"href":68},"Auth and scopes"," – how permissions, roles and scopes work across all modules.",[2399,2400,2401],"style",{},"html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":735,"searchDepth":760,"depth":760,"links":2403},[2404,2405,2406,2407,2408,2409,2410],{"id":608,"depth":760,"text":234},{"id":1230,"depth":760,"text":1231},{"id":1406,"depth":760,"text":1407},{"id":1524,"depth":760,"text":1525},{"id":1949,"depth":760,"text":1950},{"id":2299,"depth":760,"text":2300},{"id":2366,"depth":760,"text":2367},"Decide who may manage OAuth applications, which roles may sign in where and what goes into tokens.","md",null,{},{"title":234},{"title":589,"description":2411},"RgRcLo5TjNgHX0yVNOG9ANXvqPFLrVNy5xmeRpJTAJ8",[2419,2421],{"title":175,"path":231,"stem":232,"description":2420,"children":-1},"Create OAuth applications from code, define scopes, let applications call your API and sign one app in to every service.",{"title":179,"path":238,"stem":239,"description":2422,"children":-1},"Every route OAuth Server registers, how a sign-in runs, and how public and configured applications behave.",1794503155777]