Dialup.Auth.Grants (Dialup v0.2.0)

Copy Markdown View Source

Helpers for scoping MCP grants based on authentication state.

Unauthenticated sessions receive minimal read-only capabilities. After login, pages should extend this base grant with role-specific capabilities in agent_grant/1.

Summary

Functions

for_user(assigns, opts \\ [])

Returns guest grant when current_user is absent, otherwise logged_in_grant/1.

guest_grant()

Base grant for unauthenticated sessions (agent-first / pre-login).

logged_in_grant(user, opts)

Default authenticated grant; override capabilities via opts.

Functions

for_user(assigns, opts \\ [])

@spec for_user(
  map(),
  keyword()
) :: map()

Returns guest grant when current_user is absent, otherwise logged_in_grant/1.

Pages can pass extra capabilities to merge when authenticated:

def agent_grant(assigns) do
  Dialup.Auth.Grants.for_user(assigns, capabilities: [:add_item])
end

guest_grant()

@spec guest_grant() :: map()

Base grant for unauthenticated sessions (agent-first / pre-login).

logged_in_grant(user, opts)

@spec logged_in_grant(
  map() | struct(),
  keyword()
) :: map()

Default authenticated grant; override capabilities via opts.