policy

Policy authorization reference

policy refuses a request before its handler runs. Each standard operation on an entity can carry a rule evaluated against context.principal and, when the rule needs it, the loaded row — a rule that fails answers 403 with KAVO_FORBIDDEN. Full detail: docs/features/policy.md and ADR-0032/ADR-0033. Wiring context.principal itself is the global-config/kavo-decorator skills' territory (an app's own auth layer) — policy only ever reads it.

Config shape

import { and, authenticated, filtered, or, owner, permission, role } from "@kavo/core";

@Kavo(Post, {
  operations: {
    createOne: { policy: authenticated() },
    findMany: { policy: permission("post:read") },
    findOne: { policy: or(role("admin"), owner("authorId")) },
    updateOne: { policy: and(permission("post:update"), owner("authorId")) },
  },
})

policy is set per operation, at operations.<id>.policy — there is no entity-scope policy map (ADR-0033; a leftover root-level policy map fails at bootstrap, naming this path as the replacement). An operation with no policy entry is unrestricted — opt-in per operation, not a global switch. policy takes a PolicyNode only — build multi-permission checks with and(permission("a"), permission("b")) (ADR-0032, amended by #242: the array shorthand was removed since the DSL already covers everything it could express).

Node types