Skip to main content
Identity, roles, and access decisions. Authorization decides whether an authenticated principal can access a route or resource. A valid token alone does not imply access.

Request decision

A secure access decision typically considers the authenticated identity, role/permission, tenant/application context, resource ownership, and requested action. Confirm the actual middleware chain and token claims in the selected release.

Developer guidance

  • Protect every non-public route.
  • Enforce object-level ownership checks to prevent insecure direct object references.
  • Validate tenant identifiers from trusted middleware/context rather than trusting request bodies.
  • Keep authentication errors distinct from authorization denials.
  • Test both allowed and denied cases.

Source verification

The repository README describes a request path involving TenantValidationMiddleware, APP_ID, vendor lookup, tenant ID, controller, service, TypeORM, and MySQL. Confirm the exact behavior in the checked-out middleware and route code.