Function requireScopedRole

requireScopedRole(
role: string | readonly string[],
options?: ScopedGuardOptions,
): MiddlewareFunction
Guard requiring a catalogue role held in the request's scope. An array is ANY-of. Returns 501 when no authorization policy service is registered, 401 for an anonymous request (before the scope source runs), 403 when the role is not held in the scope; otherwise calls next().

Only rbac catalogue roles can be named: a role a tenant defines at runtime cannot be checked at startup, so per-scope custom roles are checked through the permissions they bundle. A name outside the catalogue fails start().
Parameters
- role: string | readonly string[]
  The role, or roles of which any one suffices
- Optionaloptions: ScopedGuardOptions
  Where the scope comes from (default: the request tenant)
Returns MiddlewareFunction
The guard middleware
Throws
When no role is named, or the scope option is malformed
Example
```
app.router.post('/invoices/:id/approve', {
  middleware: [requireScopedRole(['approver', 'admin'])],
  handler,
});
```
Since
0.9.0
- Defined in packages/auth-plugin/src/scoped/scoped-guards.ts:184