br-owned-resource-guards

Name: br-owned-resource-guards
Author: Lonsdale201

21stars1forks

How to install br-owned-resource-guards?

lonsdale201/wp-agent-skills/br-owned-resource-guards

$npx -y skills add Lonsdale201/wp-agent-skills --skill br-owned-resource-guards

Installs into the current project.

Summary

Add Better Route 1.1 ownership authorization to raw routes and Resource DSL endpoints. Use when authenticated users may access only their own records, orders, profiles, memberships, tokens, or subscriptions.

Files · 1

View on GitHub

SKILL.md

1	# Better Route ownership guards
2
3	Authentication establishes identity; ownership authorization establishes whether that identity may access this object.
4
5	## Raw route
6
7	```php
8	use BetterRoute\Middleware\Auth\OwnershipGuardMiddleware;
9
10	$guard = new OwnershipGuardMiddleware(
11	ownerResolver: static function ($context): ?int {
12	return my_resource_owner_id((int) $context->request->get_param('id'));
13	},
14	bypassCapability: 'manage_options',
15	deniedStatus: 404
16	);
17
18	$router->get('/records/(?P<id>\d+)', $handler)
19	->middleware([$auth, $guard])
20	->protectedByMiddleware('bearerAuth');
21	```
22
23	Run authentication before the guard. It resolves identity from the normalized `auth.userId`, then `auth.subject`, then the native WordPress current user. The owner resolver must load ownership server-side from the route resource; never trust a submitted owner ID.
24
25	## Resource DSL
26
27	```php
28	use BetterRoute\Resource\OwnedResourcePolicy;
29
30	Resource::make('records')
31	->policy(OwnedResourcePolicy::currentUserOwns(
32	ownerResolver: static fn (int $id): ?int => my_resource_owner_id($id),
33	ownedActions: ['get', 'update', 'delete'],
34	bypassCapability: 'manage_options',
35	allowListForAuthenticatedUsers: true
36	));
37	```
38
39	`allowListForAuthenticatedUsers: true` grants list permission to logged-in WordPress users; it does not filter the result. Apply an owner predicate in the repository/query, or disable the generated list permission, before exposing user-owned collections.
40
41	## Rules
42
43	- Prefer denial as `404` when revealing object existence would leak data. Use `403` only for an intentionally discoverable object.
44	- Use narrowly scoped, reviewed bypass capabilities.
45	- Check ownership against the current stored record during writes, not a stale client copy.
46	- Cover `get`, `update`, and `delete` independently; list filtering is a separate control.
47	- Combine write authorization with optimistic locking and atomic idempotency when concurrency or duplicate side effects matter.
48
49	Test another user's ID, absent object, anonymous access, subject-only identity, native WordPress identity, admin bypass, and list-result isolation.
50
51	Source references: `src/Middleware/Auth/OwnershipGuardMiddleware.php`, `src/Resource/OwnedResourcePolicy.php`.
52
53	## References
54
55	- Official documentation: <https://lonsdale201.github.io/better-docs/docs/better-route/agents>

People who liked this also viewed

6 picks

Type

br-owned-resource-guards

21stars1forks

View on GitHub

How to install br-owned-resource-guards?

lonsdale201/wp-agent-skills/br-owned-resource-guards

$npx -y skills add Lonsdale201/wp-agent-skills --skill br-owned-resource-guards

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Better Route ownership guards
2
3	Authentication establishes identity; ownership authorization establishes whether that identity may access this object.
4
5	## Raw route
6
7	```php
8	use BetterRoute\Middleware\Auth\OwnershipGuardMiddleware;
9
10	$guard = new OwnershipGuardMiddleware(
11	ownerResolver: static function ($context): ?int {
12	return my_resource_owner_id((int) $context->request->get_param('id'));
13	},
14	bypassCapability: 'manage_options',
15	deniedStatus: 404
16	);
17
18	$router->get('/records/(?P<id>\d+)', $handler)
19	->middleware([$auth, $guard])
20	->protectedByMiddleware('bearerAuth');
21	```
22
23	Run authentication before the guard. It resolves identity from the normalized `auth.userId`, then `auth.subject`, then the native WordPress current user. The owner resolver must load ownership server-side from the route resource; never trust a submitted owner ID.
24
25	## Resource DSL
26
27	```php
28	use BetterRoute\Resource\OwnedResourcePolicy;
29
30	Resource::make('records')
31	->policy(OwnedResourcePolicy::currentUserOwns(
32	ownerResolver: static fn (int $id): ?int => my_resource_owner_id($id),
33	ownedActions: ['get', 'update', 'delete'],
34	bypassCapability: 'manage_options',
35	allowListForAuthenticatedUsers: true
36	));
37	```
38
39	`allowListForAuthenticatedUsers: true` grants list permission to logged-in WordPress users; it does not filter the result. Apply an owner predicate in the repository/query, or disable the generated list permission, before exposing user-owned collections.
40
41	## Rules
42
43	- Prefer denial as `404` when revealing object existence would leak data. Use `403` only for an intentionally discoverable object.
44	- Use narrowly scoped, reviewed bypass capabilities.
45	- Check ownership against the current stored record during writes, not a stale client copy.
46	- Cover `get`, `update`, and `delete` independently; list filtering is a separate control.
47	- Combine write authorization with optimistic locking and atomic idempotency when concurrency or duplicate side effects matter.
48
49	Test another user's ID, absent object, anonymous access, subject-only identity, native WordPress identity, admin bypass, and list-result isolation.
50
51	Source references: `src/Middleware/Auth/OwnershipGuardMiddleware.php`, `src/Resource/OwnedResourcePolicy.php`.
52
53	## References
54
55	- Official documentation: <https://lonsdale201.github.io/better-docs/docs/better-route/agents>

People who liked this also viewed

6 picks

Type