# @askrjs/auth

> Published API exports for @askrjs/auth.

Source: [https://askrjs.com/docs/reference/api/auth/root](https://askrjs.com/docs/reference/api/auth/root)

Status: stable. Packages: @askrjs/auth.

**Published packages are authoritative.** Examples may lag behind a published contract. When guidance differs, verify the exports and TypeScript declarations in your installed package, then file an issue.

## Exports

This entrypoint publishes 19 exports from the declarations shipped by @askrjs/auth.

### `allOf`

```ts
allOf: (...requirements: readonly AuthRequirement[]) => AuthRequirement
```

Combine requirements so every requirement must allow the request.

### `anyOf`

```ts
anyOf: (...requirements: readonly AuthRequirement[]) => AuthRequirement
```

Combine requirements so at least one requirement must allow the request.

### `AuthContext`

```ts
AuthContext: any
```

Authentication state resolved for one request.

- `authenticated`: Whether a valid principal was resolved.

- `principal`: Resolved principal, or null for anonymous requests.

- `session`: Resolved session, or null when no session is active.

- `tenant`: Resolved tenant identifier, or null when unavailable.

- `scopes`: Optional scopes carried by the credential.

### `AuthDecision`

```ts
AuthDecision: {
  allowed: true;
} | {
  allowed: false;
  reason: "unauthenticated" | "forbidden" | "already_authenticated";
}
```

Result returned by an authorization requirement.

### `AuthOptions`

```ts
AuthOptions: any
```

Dependencies and policies used by the request authentication resolver.

- `sessions`: Session lookup implementation.

- `principals`: Principal lookup implementation.

- `jwt`: Validator for bearer JWTs.

- `jwtCookie`: Optional cookie name and validator for browser sessions.

- `tenant`: Resolves the tenant associated with a request.

- `sessionCookie`: Cookie name used to identify a session.

- `clock`: Clock returning Unix time in milliseconds.

### `AuthRequirement`

```ts
AuthRequirement: (context: AuthContext<P, S>) => AuthDecision | PromiseLike<AuthDecision>
```

Predicate that allows or rejects an authentication context.

### `AuthResolver`

```ts
AuthResolver: any
```

Resolves authentication context from an incoming request.

- `resolve`: Resolve the principal, session, tenant, and authorization state.
Invalid bearer and cookie JWTs fall through as unauthenticated; tenant and store failures propagate.

### `AuthSession`

```ts
AuthSession: any
```

Persisted login session associated with a principal.

- `id`: Stable session identifier.

- `subject`: Subject owning the session.

- `expiresAt`: Expiration time as Unix milliseconds.

- `revokedAt`: Revocation time as Unix milliseconds.

### `Claim`

```ts
Claim: Record<string, unknown>
```

Additional application-defined claims carried by an authenticated principal or session.

### `createAuth`

```ts
createAuth: <P extends Principal = Principal, S extends AuthSession = AuthSession>(options?: AuthOptions<P, S>) => AuthResolver<P, S>
```

Create a request authentication resolver for bearer tokens, cookies, and sessions.

### `Principal`

```ts
Principal: any
```

Stable identity and authorization attributes for a caller.

- `id`: Application-specific principal identifier.

- `subject`: External subject identifier, when supplied by an identity provider.

- `roles`: Roles granted to the principal.

- `permissions`: Fine-grained permissions granted to the principal.

### `PrincipalStore`

```ts
PrincipalStore: any
```

Resolves an authenticated principal by subject.

- `get`: Load a principal by subject.

### `requireAnonymous`

```ts
requireAnonymous: () => AuthRequirement
```

Require that the request is not already authenticated.

### `requirePermission`

```ts
requirePermission: (permission: string) => AuthRequirement
```

Require an authenticated principal carrying a specific permission.

### `requireRole`

```ts
requireRole: (role: string) => AuthRequirement
```

Require an authenticated principal carrying a specific role.

### `requireScope`

```ts
requireScope: (scope: string) => AuthRequirement
```

Require an authenticated principal carrying a specific scope.

### `requireUser`

```ts
requireUser: () => AuthRequirement
```

Require an authenticated principal.

### `SessionStore`

```ts
SessionStore: any
```

Resolves a persisted session by its identifier.

- `get`: Load a session by identifier.

### `TenantResolver`

```ts
TenantResolver: string | ((request: Request, options: {
  signal: AbortSignal;
}) => string | null | PromiseLike<string | null>)
```

Supplies the tenant identifier for an incoming request.

## Documentation navigation

[Previous](https://askrjs.com/docs/reference/api/askr/jsx-dev-runtime/index.md) | [Next](https://askrjs.com/docs/reference/api/auth/jwt/index.md)