Documentation

Documentation / zerotal / auth / AuthMiddleware

Class: AuthMiddleware

Defined in: packages/auth/src/AuthMiddleware.ts:49

Guards routes that require an authenticated user — the inverse of GuestMiddleware.

ctx.user is populated upstream by PersistUserMiddleware (registered globally by AuthProvider). This guard checks it:

• Authenticated → the request proceeds.
• Guest, expects JSON (API/XHR) → 401 Unauthenticated.
• Guest, expects HTML → the originating URL is saved to the session as intended_url and the request is redirected to redirectTo (default /login). After a successful login, send the user back with redirect().intended() / url().intended().

With mustVerifyEmail: true it additionally requires a verified email — an authenticated-but-unverified user is sent to verifyRedirectTo (default /verify-email), or gets 403 Email not verified. for JSON requests. The check is skipped on the verify page itself (so it never loops) and for user models that don't compose EmailVerification.

Use on routes (or a route group) that should only be reachable by signed-in users: Router.group({ middleware: [AuthMiddleware] }, () => { ... }); Router.flow('/dashboard', DashboardPage, [AuthMiddleware]);

Override the targets: AuthMiddleware.with({ redirectTo: '/sign-in' }) AuthMiddleware.with({ mustVerifyEmail: true, verifyRedirectTo: '/confirm-email' })

Extends

• BaseMiddleware<AuthOptions>

Constructors

Constructor

new AuthMiddleware(): AuthMiddleware

Defined in: packages/core/src/middleware/BaseMiddleware.ts:36

Returns

AuthMiddleware

Inherited from

BaseMiddleware.constructor

Properties

options

protected options: AuthOptions

Defined in: packages/auth/src/AuthMiddleware.ts:50

Subclasses must declare this with their default option values. TypeScript enforces this at compile time — forgetting it is a type error.

Overrides

BaseMiddleware.options

Methods

handle()

handle(http, next): Promise<void | Response>

Defined in: packages/auth/src/AuthMiddleware.ts:56

Parameters

http

HttpContext

next

NextFn

Returns

Promise<void | Response>

Overrides

BaseMiddleware.handle

with()

static with<T, Opts>(this, options): () => InstanceType<T>

Defined in: packages/core/src/middleware/BaseMiddleware.ts:48

Returns a zero-arg subclass with the given options deep-merged on top of the subclass defaults, usable directly in app.use([...]).

Type Parameters

T

T extends (...args) => BaseMiddleware<any>

Opts

Opts = T extends (...args) => BaseMiddleware<U> ? U : object

Parameters

this

T

options

Partial<Opts>

Returns

() => InstanceType<T>

Inherited from

BaseMiddleware.with

afterResponse()?

optional afterResponse(ctx): Promise<void>

Defined in: packages/core/src/middleware/BaseMiddleware.ts:70

Parameters

ctx

HttpContext

Returns

Promise<void>

Inherited from

BaseMiddleware.afterResponse

onError()?

optional onError(ctx, error): Promise<void>

Defined in: packages/core/src/middleware/BaseMiddleware.ts:71

Parameters

ctx

HttpContext

error

Error

Returns

Promise<void>

Inherited from

BaseMiddleware.onError