> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spurtcommerce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorization

Identity, roles, and access decisions.

Authorization decides whether an authenticated principal can access a route or resource. A valid token alone does not imply access.

## Request decision

A secure access decision typically considers the authenticated identity, role/permission, tenant/application context, resource ownership, and requested action. Confirm the actual middleware chain and token claims in the selected release.

## Developer guidance

* Protect every non-public route.
* Enforce object-level ownership checks to prevent insecure direct object references.
* Validate tenant identifiers from trusted middleware/context rather than trusting request bodies.
* Keep authentication errors distinct from authorization denials.
* Test both allowed and denied cases.

## Source verification

The repository README describes a request path involving `TenantValidationMiddleware`, `APP_ID`, vendor lookup, tenant ID, controller, service, TypeORM, and MySQL. Confirm the exact behavior in the checked-out middleware and route code.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.