RBAC

RBAC is built into the Auth class. Roles and user-role assignments are stored in the authRoles and authUserRoles tables.

Create a role

await auth.rbac.createRole({
  name: "admin",
  permissions: ["users:read", "users:write", "*"],
});

await auth.rbac.createRole({
  name: "viewer",
  permissions: ["users:read"],
});

Permissions are strings. Use * as a wildcard.

Assign a role to a user

await auth.rbac.assignRole(userId, "admin");

Check permissions

const canWrite = await auth.rbac.authorize(userId, "users:write");
// true | false

const isAdmin = await auth.rbac.hasRole(userId, "admin");

Get user roles

const roles = await auth.rbac.getUserRoles(userId);
// Role[] — each with id, name, permissions, createdAt

API

Method	Purpose
auth.rbac.createRole({name, permissions})	create a role
auth.rbac.deleteRole(roleId)	delete a role
auth.rbac.assignRole(userId, roleName)	assign by name
auth.rbac.removeRole(userId, roleName)	remove from user
auth.rbac.getUserRoles(userId)	list roles for a user
auth.rbac.hasRole(userId, roleName)	check exact role
auth.rbac.authorize(userId, permission)	check permission (supports * wildcard)

Best practices

• Define roles at startup (seed them in a migration).
• Prefer authorize with granular permissions over hasRole.
• Use * sparingly — explicit permissions are easier to audit.

Common mistakes

• Forgetting to include authRoles and authUserRoles in your mountsqli tables array.
• Assigning a role that doesn’t exist yet.

Related

• OAuth & Providers — assign roles on OAuth callback.
• Sessions — session data includes the user.