Capability grants (request → approve → expire)

Generated from pattern-library/registry.json — do not edit by hand; change the registry and run bun run patterns:build.

Index card — the docs below are the canonical explanation; deep-tier pattern pages additionally carry invariants and emulation notes.

Category: Identity & Access · Tier: light · Maturity: proven (verified 2026-08-20 @ 1a130d67) · Risk: low — application-level authorization logic, Postgres-backed

A request-approve-expire workflow where users request a named capability, an admin approves or denies it, and pending requests auto-expire after 14 days.

When to use: Use in place of static roles when access to a feature, such as blog authoring, needs an auditable grant/revoke lifecycle.

Docs

• docs/blueprint/auth.md (GitHub · GitLab)

Code

• src/lib/server/auth/grants.ts (GitHub · GitLab)
• src/lib/server/auth/grant-requests.ts (GitHub · GitLab)

Tests

• src/lib/server/http/guards.test.ts — Covers grant-based capability checks (GitHub · GitLab)

Machine-readable record: identity-capability-grants in pattern-library/registry.json.