Authorization

Authentication identifies; authorization decides. Enforce permissions in server routes and policies, including object ownership. UI hiding is never an authorization boundary.

Practical example

Check the exact permission at the mutation boundary; hiding UI is only a convenience.

export const DELETE = async (ctx) => {
  await requirePermission(ctx, "member:delete");
  await deleteMember(ctx.params.id, ctx.state.user.tenantId);
  return new Response(null, { status: 204 });
};

What to verify

Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.

Configuration

Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.

Implementation workflow

bunx wrnexus doctor .
bunx wrnexus typecheck .
bunx wrnexus inspect routes .
bunx wrnexus build .

Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.

Verification checklist

• Inputs are validated at the authoritative server boundary.
• Authentication and resource authorization are tested independently.
• Generated routes and application types are current.
• Error, empty, loading, denied, and success states are documented.
• The production artifact starts and serves the expected route.

Release scope

This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.

Browse package APIs · CLI reference · Troubleshooting · Support