Interface AuthPluginOptions

API key configuration. Optional.

Authorization decision-explanation observation (M98h). When present, the plugin attaches a collector to its own RbacService and registers an IAuthorizationDiagnosticsSource under CAPABILITIES.AUTHORIZATION_DIAGNOSTICS. When absent, the same token is still registered with a disabled-answering source. The boolean IAuthorizationService remains authoritative and unchanged; a diagnostic failure can never alter an allow/deny or a guard's short-circuit order.

Outbound HTTP seam for issuers and signIn. Defaults to one over fetch.

Outside identity providers whose access tokens are accepted (M100b). Builds an internal issuers strategy placed immediately after the JWT strategy, reading the same header and scheme as jwt, and registers an auth health indicator reporting each issuer's cached key-set state.

JWT configuration. Omit when the application uses another strategy.

Local credentials configuration. Optional.

Global authentication middleware configuration. Omit to register it at priority 300, or pass false when attaching it per route yourself.

Authorization policies — asynchronous, target-aware checks registered under CAPABILITIES.AUTHORIZATION_POLICIES (M110a). Build each with definePolicy. Validated when AuthPlugin(...) is called: a malformed policy or two policies sharing a name refuse before any application exists. The policy service is registered whether or not this is set, so DecoratorPlugin's class-form policies have a registry too; it is sealed once the application starts.

RBAC configuration. When absent, AuthPlugin registers JWT authentication only and does not provide the authorization capability.

Scoped RBAC (M110b): roles granted IN a scope — a tenant, an organisation, a team — evaluated as the built-in scoped-rbac policy and checked with requireScopedRole, requireScopedPermission and DecoratorPlugin's @ScopedRoles/@ScopedPermissions. Requires rbac, whose roles are the catalogue. Validated when AuthPlugin(...) is called.

Session authentication configuration. When present, the plugin appends an internal session strategy after the API-key strategy and requires the session capability (SessionPlugin) to be registered.

Sign-in with an outside provider (M100c). Registers the sign-in routes, the auth-session authentication strategy, and CAPABILITIES.AUTH_SESSION, and requires the session capability (SessionPlugin).

Caller-supplied strategies, appended after every built-in in declaration order. A strategy whose name collides with any other strategy in the assembled chain makes register() throw.