RBAC concepts#
The auth package exports role and permission models, repository contracts, service/facade APIs and the types UserRole and UserPermission. In the inspected source, UserRole is "user" | "admin" | string and permissions are strings; the application owns the vocabulary and policy.
Identity augmentation#
The package exposes registries for identity, session and password-reset-session augmenters. Use registerIdentityAugmenter, registerSessionAugmenter and registerPasswordResetSessionAugmenter to attach application-owned data, and the corresponding unregister functions to remove a registration. The registries compose partial results in sequence.
Augmentation is useful for integrating a tenant ID, profile data or additional session flags, but it should not be the only place where access control is enforced. Treat any added client-visible field as data that must be intentionally exposed.
