Method decorator: state what a handler authorizes.
@Can('update', 'Post') // the ability the caller must hold @Can('update', 'Post', 'title') // narrowed to a field @Can('post.update') // a registered policy
Like @Protect, @Validate and @Returns, this knows nothing about the router: the rule is
recorded on the handler under this module's own key, so it holds in a routed application, a
single-handler service, a CLI command or the browser. A router, when present, can carry it on the
route instead ({ authz: { action: 'update', subject: 'Post' } }).
Declaring the rule rather than wiring a guard is what makes it readable: @stone-js/openapi
publishes the endpoint as protected, and a policy can be inspected, tested and reused.
Type Parameters
TextendsFunction = Function
Parameters
action: string
The action, or a registered policy name when it is the only argument.
Method decorator: state what a handler authorizes.
Like
@Protect,@Validateand@Returns, this knows nothing about the router: the rule is recorded on the handler under this module's own key, so it holds in a routed application, a single-handler service, a CLI command or the browser. A router, when present, can carry it on the route instead ({ authz: { action: 'update', subject: 'Post' } }).Declaring the rule rather than wiring a guard is what makes it readable:
@stone-js/openapipublishes the endpoint as protected, and a policy can be inspected, tested and reused.