Route guards & per-route authorization

Generated from mcp/patterns.registry.json — do not edit by hand; change the registry and run bun run patterns:build.

Index card — the docs below are the canonical explanation; deep-tier pattern pages additionally carry invariants and emulation notes.

Category: Identity & Access · Tier: light · Risk: low — application-level authorization logic, no external calls

Server-side guard functions that check a user's capability grants or admin status before allowing access to a route or API endpoint.

When to use: Use on any route or endpoint that must restrict access beyond plain authentication, including the 404-not-403 admin gate.

Docs

• docs/blueprint/auth.md (GitHub · GitLab)

Code

• src/lib/server/auth/guards.ts (GitHub · GitLab)

Proof

• /showcases/auth/authz

Machine-readable record: identity-route-guards in mcp/patterns.registry.json.