nocobase-app-plugin-authorization

Register the module's collection with authz.database.collections.add(), run authz.middleware() before routes, and call authorize() in each route to obtain database conditions. The module's service then applies the returned filter and field limits inside its queries.

Use authz.guard() for routes needing a simple permit or deny decision, passing the resource and action. For database CRUD routes, use authorize() instead because the decision carries record filters and field conditions the service must apply.

Permission Sets grant actions to subjects and may include field and record policy. Sharing Rules expand record access for selected subjects, while Restriction Rules narrow effective access as a mandatory upper bound. Default Access sets a resource-wide baseline.

Verify the resource id matches the registered resource, the action is registered, and middleware resolved the principal and subjects. Then check Permission Set assignments, Default Access, Sharing Rules, and Restriction Rules, and call authz.explain() with the same request to inspect decision reasons.

No. For update and delete, the returned record filter must be placed in the same SQL WHERE clause as the record id. Fetching first and filtering in memory bypasses the authorization boundary and can expose or modify unauthorized records.