k.accessControl
Type the access control map against your routes, identities and roles, beside the routes.
The least settled part of kizuna. k.accessControl may change shape, move out of the contract, or be removed before v2. Pin your version, and expect to rewrite what you build on it.
k.accessControl(routes, map) returns the map typed against the routes, the identities and the roles they declare, for defining it beside the routes rather than inside k.contract:
export const accessControl = k.accessControl(routes, {
health: false,
users: 'user',
projects: {
'*': 'member',
deleteProject: {
auth: 'member',
roles: 'owner',
},
},
});
export const contract = k.contract({
routes,
accessControl,
});What an entry can say
| Entry | Meaning |
|---|---|
false | Public |
'member' | Requires the member identity, any role |
{ auth, roles?, requires? } | The same, narrowed to roles, or permissions the caller has to hold |
{ '*': ..., login: false } | '*' is the group default, named keys override it |
auth is one identity name or an array of them, and an array requires every one. roles is one of the identity's declared role names or several, and the caller passes holding any of them. requires names permissions from the catalog the identity's roles are built from, and the caller passes holding all of them. Both are type errors on an identity that declares nothing to check them against, and a typo in either does not compile. On an OAuth identity, requires is also the scopes the token has to carry.
A subgroup key covers its whole subtree, and can nest its own '*'. A key matching nothing in the group is an error, and so is a nested cascade on a route key.
k.contract resolves the map onto every route's security, roles and requires, which the guards, the router types and the OpenAPI document all read. See Access Control for the walkthrough.