Security
17 pages.
How authorization works in Osy#, end to end. Everything is denied until you grant it; a grant is compiled into every query rather than checked…
The two server-side calls that finish an OAuth sign-in on your own pages. When someone signs in with a provider (Google, …) and has no account yet —…
`[AuthMethod]` marks a sign-in function — login, signup, password-reset — as reachable by a visitor who is not signed in. Everything else in your app…
A shared terminal, a kiosk, a scanner or a back-office integration is a **user of your app**, not a mode of it. It holds its own `[Principal]` row…
`app.Auth` binds two properties of your `[Principal]` — which one is the login, which one holds the password hash — and with that the platform can…
Under deny-all, login faces a paradox: it must read a user row *before* anyone is authenticated. `app.AuthBootstrap` resolves it. You name a…
Some capability tables hold rows that belong to one signed-in user — a chat conversation is yours, not the app's. Those capabilities scope every read…
A `where` row filter may follow relations as far as the model goes — `Folder.Workspace.Region.Head == user` is a four-hop rule, and the principal…
Names an authorization rule once so every place that needs it can say the name. A policy is a boolean about the caller, usable where security is…
Two built-in `when` predicates say who a request is: `IsAuthenticated` is a signed-in user, `IsAnonymous` is an unauthenticated visitor, and…
A public page, its public data and its public actions are three separate declarations. `[AllowAnonymous]` on a component says a signed-out visitor…
A role is granted by an ordinary entity — any entity that has both a reference to your `[Principal]` and a property typed as your `[Role]` enum is a…
Some platform shapes decompose into several tables — a schedule owns its rules, and a rule owns its times, weekdays and month-days. Those child rows…
Deny-all is the posture, and it is the only one: an entity that declares no `security { }` block is denied to every user request, and you grant…
The rules that decide who may read and write an entity's rows. A where clause filters by the row (the owner sees their own); a when clause gates by…
How an app lets somebody INVITE a person who has no account yet. The invitation is a workflow: it mints a tokenised accept link the invitee can…
When a write is refused, two different sentences are produced from it. The person using your app gets a short one that names the operation and the…