Requires the authenticated principal to hold any of the given roles. May be
applied at the class level (default for all routes) or method level
(overrides the class default).
Enforced by DecoratorPlugin unless enforceRoles: false: the route's
chain gets middleware that answers 401 without a principal, 403 when
the principal holds none of the roles, and — when no authorization provider
is registered at all — 501 (fail closed, with a startup warning naming
both remedies).
Requires the authenticated principal to hold any of the given roles. May be applied at the class level (default for all routes) or method level (overrides the class default).
Enforced by
DecoratorPluginunlessenforceRoles: false: the route's chain gets middleware that answers401without a principal,403when the principal holds none of the roles, and — when no authorization provider is registered at all —501(fail closed, with a startup warning naming both remedies).