@appport/authorization

The capability authorization model.

Authorization in AppPort operates on capabilities, never on transports. A capability declares the permissions it requires; an authorizer decides whether the caller holds them.

import { permissionAuthorizer, combineAuthorizers, authorizerFrom } from "@appport/authorization";

const authorizer = combineAuthorizers([
  permissionAuthorizer(),
  authorizerFrom("owner", ({ session, input }) => isOwner(session, input))
]);

• permissionAuthorizer() — the session's permissions must cover the capability's. Wildcards (documents.*, *) are supported.
• authorizerFrom(name, fn) — resource-level policy.
• combineAuthorizers([...]) — every authorizer must allow; first denial wins.
• allowAllAuthorizer() — local runtimes and tests only.

UNAUTHORIZED and FORBIDDEN are distinguished deliberately: a client needs to tell "sign in" from "you cannot do this".

Nothing here infers trust from the carrier. Desktop IPC is not identity, and neither is HTTPS.