Decide, route by route, who may call your service.
A gateway or an identity provider has authenticated the caller and passes the identity on — as HTTP headers, or as a signed JWT. granted reads it, checks what each route requires, and hands your code the caller: username, roles, tenant, and any other claim.
// NestJS
@Get('stations')
@GrantedTo(hasRole('FORECASTER'))
list(@GrantedClaim('territories', { type: 'string', array: true }) territories: string[]) {
return this.stations.find({ where: { territory: In(territories) } });
}Roles decide which actions a caller may take; claims scope which data. Each route's rule also reads in the service's OpenAPI document.
| Package | |
|---|---|
@softwarity/nestjs-granted |
NestJS |
io.softwarity:quarkus-granted |
Quarkus |
github.com/softwarity/granted/go/v5 |
Go (net/http) |
Every package carries one version: they implement the same behaviour, so a service in one language and a service in another, on the same number, decide the same way.
📚 Documentation: softwarity.github.io/granted
See CONTRIBUTING.md. Changes go under ## NEXT RELEASE in RELEASE_NOTES.md.