security

func Authorize ¶

func Authorize() sdk.Definition

Authorize attaches a secure-deny authorization policy to one HTTP route or interface-bound managed service method.

At least one authentication, role, scope, or expression requirement is required. Multiple categories are combined with AND semantics; anyRoles requires one listed role while allRoles and allScopes require every listed value. The optional expression is compiled against Boolean `authenticated`, string `subject` and `issuer`, and Boolean hasRole(string)/hasScope(string) functions. Declaring an expression still requires an authenticated principal. It cannot navigate properties, look up beans, invoke arbitrary methods, allocate, assign, or perform I/O.

// @import { Authorize } from "github.com/spice-framework/spice/annotation/security"
// @Authorize(authenticated=true, anyRoles=["operator", "admin"])

func AuthorizeHandler ¶

func AuthorizeHandler(
	_ context.Context,
	invocation sdk.Invocation,
) (sdk.Result, error)

AuthorizeHandler contributes a generated secure-deny method policy.