Function ScopedRoles

ScopedRoles(
roles: readonly string[],
scope?: ScopeSource,
): SetuClassOrMethodDecorator
Requires the principal to hold ANY of the given catalogue roles in the request's scope. May be applied at the class level (default for all routes) or method level (overrides the class default).

The route answers 401 without a principal (before the scope source runs), 403 when no role is held in the scope, 501 with no authorization policy service registered. Only rbac catalogue roles can be named: a role a tenant defines at runtime is checked through the permissions it bundles.
Parameters
- roles: readonly string[]
  The roles, any one of which suffices
- Optionalscope: ScopeSource
  Where the scope comes from (default: the request tenant)
Returns SetuClassOrMethodDecorator
A class or method decorator
Throws
When roles is empty or holds a non-string
Example
```
@Post('/invoices/:id/approve')
@ScopedRoles(['approver', 'admin'])
approve() { … }
```
Since
0.9.0
- Defined in packages/decorator-plugin/src/decorators/scoped.ts:61