App: auth

Who signs in, which roles exist, and what each role may read and change. Preview keys work and may change in any release (status); the rest are stable. All parts.

auth: {
  providers: ['email'],
  defaultRole: 'viewer',
  roles: {
    viewer: { label: 'Viewer', read: true },
    manager: { label: 'Manager', read: true, write: ['opportunity'], commands: ['assignReviewer'], operations: ['readiness'] },
  },
},

Present, every request needs a session. A role takes a label for people, read (true or a list), write (within its reads), commands (command ids), actions ({ pay_run: ['approve'] }: fixed actions without write), operations, fields and, from an identity provider, from (the claims that grant it). Omitted grants deny, and every grant is enforced by the server, not the screen. An account holding admin manages accounts from the account menu. See Sign-in, Roles and field access and Row access.

auth

Key	Type	Status	What it does
auth	object	Stable	Sign-in for this App, through Better Auth. Present, every request needs a session. Used in examples/apps/lintel/app.ts.

auth.defaultRole

Key	Type	Status	What it does
auth.defaultRole	string	Stable	The role a new account gets. Default: user.

auth.me

Key	Type	Status	What it does
auth.me	object	Stable	Who me is as a row: the table people are rows of and its column holding their sign-in email, so owner_id = me compares a reference to that table with the signed-in person’s row. Without it, me is the account’s email and compares with text columns only. In a tenant App column holds the account’s id, and me is the row of the tenant the request is in; a tenant with no row for them matches nothing. Used in examples/apps/lintel/app.ts.
auth.me.column	string	Stable	Used in examples/apps/lintel/app.ts.
auth.me.create	object	Stable	Make each new account’s row the first time it is signed in to the App: its email in column (which must be unique) and, where name names a column, its name there. Every other column the row needs must have a default. Not in a tenant App yet. Used in examples/apps/lintel/app.ts.
auth.me.create.name	string	Stable	Used in examples/apps/tick/app.ts.
auth.me.from	string	Stable	Used in examples/apps/lintel/app.ts.

auth.providers

Key	Type	Status	What it does
auth.providers	array	Stable	How people sign in. GitHub and Google read their client id and secret from the environment; an identity provider’s are its config entry’s. Used in examples/apps/lintel/app.ts.

auth.public

Key	Type	Status	What it does
auth.public	object	Stable	What a signed-out visitor reads: each resource named, read-only, optionally narrowed by fields; the rest of the App still needs a session. Needs roles, and rows ‘all’. Used in examples/apps/lintel/app.ts.
auth.public.fields	object	Stable	Used in examples/apps/tick/app.ts.
auth.public.fields.*.read	array	Stable	Used in examples/apps/lintel/app.ts.
auth.public.read	array	Stable	Used in examples/apps/lintel/app.ts.

auth.roles

Key	Type	Status	What it does
auth.roles	object	Stable	Grants within the resource ceilings. Needs at least one resources.<r>.access; omitted grants deny.
auth.roles.*.actions	object	Stable	Fixed actions the role runs without write, by resource and action id: { pay_run: [‘submit’] }. Each resource is one the role reads, with access ‘write’, and does not write; each id is one of its fixed (set) actions. The server admits the update only as that action: its set, its reason column, its when on the stored row. Needs auth.rows ‘all’. Used in examples/apps/tick/app.ts.
auth.roles.*.claims	object	Stable	The identity provider’s claims that give this role: { <claim, or a dotted path into one>: [values] }. Re-read at every sign-in; not in a tenant App.
auth.roles.*.commands	array	Stable	Explicit server command identifiers only. No wildcard grants or implied CRUD access. Default []. Used in examples/apps/lintel/app.ts.
auth.roles.*.create	array	Stable	Of what the role writes, what it makes new records in. Absent: everything it writes. false: it edits and never creates (no New, quick add or related add, and the server refuses the insert). A list names the few it creates. One of false. Used in examples/apps/lintel/app.ts.
auth.roles.*.experiments	array	Preview
auth.roles.*.experiments[].actions	array	Preview	Used in examples/apps/tick/app.ts.
auth.roles.*.experiments[].environments	array	Preview
auth.roles.*.experiments[].ids	array	Preview
auth.roles.*.experiments[].owners	array	Preview
auth.roles.*.export	array	Stable	Tables the role may export (the whole matching list as a CSV or JSON file) beyond those it writes, which it always may. Of what it reads. A signed-out visitor never may. An App without role grants keeps its one switch, ui.export. Used in examples/apps/lintel/app.ts.
auth.roles.*.extends	string	Stable	Another role whose grants this one holds too: { manager: { extends: ‘mechanic’, commands: [‘approveQuote’] } }. A chain is followed; a loop is refused. Only grants pass down, each the union of both; never label, claims or service, and only within one realm. A view’s or page’s roles open to a role that extends one they name; a row policy’s principal.roles still match by name. Used in examples/apps/lintel/app.ts.
auth.roles.*.fields	object	Stable	Column narrowing per resource, within the resource’s own fields. Omit read to narrow only write. Used in examples/apps/tick/app.ts.
auth.roles.*.fields.*.read	array	Stable	Used in examples/apps/lintel/app.ts.
auth.roles.*.fields.*.write	array	Stable	Needs the resource’s access ‘write’. Used in examples/apps/lintel/app.ts.
auth.roles.*.flags	array	Preview
auth.roles.*.flags[].actions	array	Preview	Used in examples/apps/tick/app.ts.
auth.roles.*.flags[].environments	array	Preview
auth.roles.*.flags[].ids	array	Preview
auth.roles.*.flags[].owners	array	Preview
auth.roles.*.label	string	Stable	The role’s name as people read it, wherever a screen names the role (accounts, grants, invitations). Absent: the id, made readable. Words only; it grants nothing.
auth.roles.*.operations	array	Stable	Operator reads over the authenticated App host: readiness, bundle (the sanitized support bundle) and workflows (the durable workflows room, with Cancel and Retry). In a suite’s Console, for this App only: workflows, jobs (list and redrive), deliveries (event and webhook deliveries, list and redrive), stores (store layout status) and analytics (read-only). With the platform realm, support reads the support sessions of the role’s own realm: a tenant role its own tenant’s, a platform role every tenant’s (the one view naming the operator); never granted by a feature. Independent of data and command grants. Used in examples/apps/lintel/app.ts.
auth.roles.*.read	boolean | array	Stable	true grants the read ceiling (every declared resource); a list names some of them. Default false. Used in examples/apps/lintel/app.ts.
auth.roles.*.realm	"tenant" · "platform"	Stable	The realm the role grants in: a tenant’s (the default) or the platform realm’s. Required on every role once auth.tenancy.platform is declared; a platform role edits only the platform’s own writable resources, never the profile’s New, and changes a tenant’s rows only through its commands. One of platform, tenant.
auth.roles.*.service		Stable	A role only a service principal holds (a jobs module’s principals, an App API token), never a person: a free-form page is offered to it only where the page names it; it is never defaultRole and has no claims. One of true. Used in examples/apps/lintel/app.ts.
auth.roles.*.write	boolean | array	Stable	true grants the write ceiling (resources with access ‘write’), within the role’s reads. Default false. Used in examples/apps/lintel/app.ts.

auth.rows

Key	Type	Status	What it does
auth.rows	"all" · "policy" · "tenant"	Stable	Row scoping: every row (default), a server-defined row policy (needs named sources), or tenant enrollment (exactly one named source). One of all, policy, tenant. Used in examples/apps/lintel/app.ts.

auth.signUp

Key	Type	Status	What it does
auth.signUp	string | object	Stable	invite (default): an admin creates accounts. open: anyone may sign up. { providers, domains }: an account is made at its first sign-in through an identity provider, with a verified email in one of the domains. One of invite, open.
auth.signUp.domains	array	Stable
auth.signUp.providers	array	Stable	Used in examples/apps/lintel/app.ts.

auth.store

Key	Type	Status	What it does
auth.store	string	Stable	The SQLite file sessions live in. Default: the tablewalk config directory, named for the app. Used in examples/apps/lintel/jobs.ts.

auth.tenancy

Key	Type	Status	What it does
auth.tenancy	object	Stable	What one tenant is called, the platform-owned profile resource with one row per tenant, and the platform realm with its label. Only with auth.rows ‘tenant’.
auth.tenancy.label	string	Stable	What one tenant is called in the chooser and the browser’s own words (“Dealer”).
auth.tenancy.platform	object	Stable	Declares the platform realm, the business above the tenants. The server-only policy must then declare resolvePlatformRows.
auth.tenancy.platform.label	string	Stable	What the platform realm is called in the chooser (“Lender”).
auth.tenancy.platform.me	object	Stable	Who me is in the platform realm, as auth.me says it in a tenant’s: the platform-owned resource its staff are rows of, and the column holding each one’s account id, so a provider view can say owner_id = me. A tenant’s member is never this row, and the platform’s staff are never a tenant’s person. Used in examples/apps/lintel/app.ts.
auth.tenancy.platform.me.column	string	Stable	Used in examples/apps/lintel/app.ts.
auth.tenancy.platform.me.from	string	Stable	Used in examples/apps/lintel/app.ts.
auth.tenancy.profile	string	Stable	The platform-owned resource with one row per tenant. A tenant’s row may reference it, only through its ownership column.