Setu-TS
    Preparing search index...

    Interface IAuthorizationPolicyService

    The authorization policy service — one evaluator behind every entry point (route guard, decorator, imperative check), so they cannot disagree.

    The evaluation semantics are fixed rather than configurable:

    • an unknown policy or ability REJECTS, naming it — never a deny;
    • an anonymous principal is denied (401) unless the ability opted in;
    • for a signed-in principal, before runs first: true allows, undefined falls through, anything else denies;
    • the check allows only on a literal true;
    • a throw or rejection from before or the check DENIES, and is reported to the logger — it never answers 200.
    const policies = ctx.services.get<IAuthorizationPolicyService>(
      CAPABILITIES.AUTHORIZATION_POLICIES,
    );
    if (await policies.can(ctx.request.user ?? null, postPolicy, 'update', post)) {
      // render the edit button
    }
    await policies.authorize(ctx.request.user ?? null, postPolicy, 'update', post);

    0.9.0

    interface IAuthorizationPolicyService {
        authorize<A extends string, T>(
            principal: IPrincipal | null,
            policy: PolicyRef<A, T>,
            ability: A,
            target?: T,
        ): Promise<void>;
        can<A extends string, T>(
            principal: IPrincipal | null,
            policy: PolicyRef<A, T>,
            ability: A,
            target?: T,
        ): Promise<boolean>;
        define(policy: PolicyDefinition): void;
        describe(policy: string, ability: string): PolicyAbilityInfo | undefined;
    }
    Index
    authorize can define describe

    • Evaluates one ability and rejects when it is denied.

      The deny rejection carries an HTTP status hint (401 for an anonymous principal, 403 otherwise), so an application's error handler answers it with the same body the authorization guards write.

      Type Parameters

      • A extends string
      • T

      Parameters

      • principal: IPrincipal | null

        The principal, or null when anonymous

      • policy: PolicyRef<A, T>

        The policy name, or its definition

      • ability: A

        The ability name

      • Optionaltarget: T

        The target the check receives

      Returns Promise<void>

      Resolves when allowed

      — as a REJECTION: when denied, or when the policy or ability is unknown

    • Evaluates one ability.

      Type Parameters

      • A extends string
      • T

      Parameters

      • principal: IPrincipal | null

        The principal, or null when anonymous

      • policy: PolicyRef<A, T>

        The policy name, or its definition

      • ability: A

        The ability name

      • Optionaltarget: T

        The target the check receives

      Returns Promise<boolean>

      true when allowed

      — as a REJECTION: when the policy or ability is unknown

    Settings
    Member Visibility

    On This Page
    Methods