The policy
The validated, frozen policy
When the name is not lowercase
kebab-case, there are no abilities, an ability is named before or is not a
check, or before is not a function
const postPolicy = definePolicy({
name: 'post',
abilities: {
update: (principal, post: Post | undefined) => post?.authorId === principal.id,
read: { anonymous: true, check: (_principal, post: Post | undefined) => post?.published === true },
},
before: (principal) => (principal.roles?.includes('admin') ? true : undefined),
});
Defines an authorization policy: validates it and returns a frozen copy typed by its ability names and target, so
requirePolicy(policy, 'updaet')is a compile error.The target type is inferred from a check's annotated parameter; an unannotated check receives
unknown. Only a literaltrueallows. An ability sees an anonymous (null) principal only when declared as{ anonymous: true, check }; otherwise an anonymous request is denied (401) before the check runs.beforeruns for a signed-in principal only:trueallows,undefinedfalls through, anything else —nullincluded — denies.Register the result through
AuthPlugin({ policies: [...] }).