Authorization

GateKeeper resolves credentials into a security context. @Guard evaluates requirements against that identity. In 4.0.0 the container and authentication registrations belong to each application.

Register authentication

Apply @GateKeeper(AuthContext, AuthContextResolver) to the application module. The context implements SecureContext; its OnGuard maps verified authentication data into a SecureProperty. The resolver implements AuthResolver, selects credentials (for example, the authorization header), and validates them before returning an identity.

Use the exported GATEKEEPER and GATEKEEPER_RESOLVER token identities when registering these dependencies explicitly. Reject missing or invalid credentials before assigning privileged roles.

Protect a route

import 'reflect-metadata';
import {Guard} from '@heronjs/common';
import {Rest, Get} from '@heronjs/express';
 
const adminOnly = Guard({roles: ['admin']}) as MethodDecorator;
 
@Rest('/reports')
export class ReportsController {
  @Get({uri: '/'})
  @adminOnly
  list() {
    return [];
  }
}

The 4.0.0 declaration currently types the Guard factory result as unknown; the example narrows its known method-decorator result to MethodDecorator.

Register the controller and authentication configuration in your module. Both class and method guards apply. Evaluation awaits promised requirements and asynchronous or Observable predicates. Missing identity, mismatched requirements, empty predicates and failed evaluation deny access.

HTTP exposes the resolved identity as request.authContext, accessible with @Principal(). WebSocket, MCP and ACP have their own authentication options; see their guides for connection and endpoint boundaries. MCP token verification and ACP application authentication retain their protocol-specific contracts.