Clintchiz
fd5e2b7128
Task 15 of the authz permissions plan: proves db store + cache + catalog + middleware + audit compose correctly, wires a real (non-dangling) example into auth-showcase, and documents the declaration/registration/precedence surface in the package README.
25 lines
1.1 KiB
TypeScript
25 lines
1.1 KiB
TypeScript
import { authzMiddleware, getAuthzCatalog, memoryPermissionStore } from "@wrnexus/authz";
|
|
|
|
/**
|
|
* Registers the per-request authorization resolver against the catalog merged
|
|
* from `app/authz/*.ts` (see `showcase.ts`). This is an eager, module-scope
|
|
* call — the same shape `authzMiddleware({...})` requires — so it must run
|
|
* after `getAuthzCatalog()` has been populated. Both the dev server and
|
|
* `wrnexus build`'s generated production entry guarantee that happens before
|
|
* any app middleware module evaluates.
|
|
*
|
|
* Middleware runs in alphabetical filename order, so `authz.ts` runs after
|
|
* `auth.ts`, which hydrates `ctx.user` from the session. Route handlers and
|
|
* pages can then call `can(ctx, "post:write")` or guard a route with
|
|
* `guardPermission("post:delete")`.
|
|
*
|
|
* A real deployment would swap `memoryPermissionStore()` for
|
|
* `dbPermissionStore(getDb())` from `@wrnexus/authz/db` so role and grant
|
|
* assignments survive a restart; the showcase keeps everything in memory so
|
|
* it stays dependency-free.
|
|
*/
|
|
export default authzMiddleware({
|
|
catalog: getAuthzCatalog(),
|
|
store: memoryPermissionStore(),
|
|
});
|