# @appport/authorization

> Capability authorization model for AppPort.

Latest version **1.0.1** (published 2026-09-24) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install @appport/authorization
pnpm add @appport/authorization
yarn add @appport/authorization
bun add @appport/authorization
```

## Health

**Score 65/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; recently updated; high maintenance score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 1.0.1 |
| Published | 2026-09-24 |
| First published | 2026-09-21 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 1 |
| Unpacked size | 18.6 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Maintainers | rkendel |

## Links

- npm: https://www.npmjs.com/package/@appport/authorization
- Repository: https://github.com/rkendel1/appport
- Homepage: https://github.com/rkendel1/appport#readme
- Issues: https://github.com/rkendel1/appport/issues
- npm.io page: https://npm.io/package/@appport/authorization

## Dependencies (1)

- [@appport/protocol](https://npm.io/package/@appport/protocol.md) 1.0.1

## Recent versions

- 1.0.1 (latest) — 2026-09-24
- 1.0.0 — 2026-09-21

## README

# @appport/authorization

The capability authorization model.

Authorization in AppPort operates on capabilities, never on transports. A
capability declares the permissions it requires; an authorizer decides whether
the caller holds them.

```ts
import { permissionAuthorizer, combineAuthorizers, authorizerFrom } from "@appport/authorization";

const authorizer = combineAuthorizers([
  permissionAuthorizer(),
  authorizerFrom("owner", ({ session, input }) => isOwner(session, input))
]);
```

- `permissionAuthorizer()` — the session's permissions must cover the
  capability's. Wildcards (`documents.*`, `*`) are supported.
- `authorizerFrom(name, fn)` — resource-level policy.
- `combineAuthorizers([...])` — every authorizer must allow; first denial wins.
- `allowAllAuthorizer()` — local runtimes and tests only.

`UNAUTHORIZED` and `FORBIDDEN` are distinguished deliberately: a client needs to
tell "sign in" from "you cannot do this".

Nothing here infers trust from the carrier. Desktop IPC is not identity, and
neither is HTTPS.

---
_Source: https://npm.io/package/@appport/authorization · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._