authorization

Restricts what a caller may do or see, based on provider, user, or rate.

Name	Category	Description
disallow	hooks	Prevents access to a service method completely or for specific transports. When called without arguments, the method is blocked for all callers. When called with transport names, only those transports are blocked.
rateLimit	hooks	Rate limits service method calls using rate-limiter-flexible. You provide a pre-configured RateLimiterAbstract instance (Memory, Redis, Mongo, etc.) and the hook consumes points per request.
setField	hooks	Sets a field on the hook context (e.g. params.query) based on the value of another context field (e.g. params.user.id). Useful for scoping queries to the authenticated user. Throws a Forbidden error if the source field is missing (unless allowUndefined is true).
throwIfIsProvider	hooks	Throws a MethodNotAllowed error when the request comes from one of the specified transports. Combines throwIf with the isProvider predicate for a convenient one-liner. Use this to restrict methods to server-only or specific transport types.
gateParams	utils	Selects and/or projects params keys according to a declarative path schema, returning a NEW object. General-purpose — no cache knowledge. Typically composed into the cache hook's transformParams option as (p) => gateParams(p, schema, opts). Paths are resolved with lodash get/has and written with set, so nested values can be picked declaratively ('user.id': true). params is never mutated: kept values are copied over by reference into the fresh result (safe, since the result is only read/serialized). The one exception is combining a top-level rule with a nested path under the SAME parent in one schema (e.g. { query: true, 'query.x': ... }) — the nested set would then write into the shared parent. Pick one granularity per parent to avoid it. query is included as-is by DEFAULT (it is always relevant), unless the schema addresses it explicitly — either as query or a nested query.* path. Keys not mentioned in the schema are KEPT by default, so forgetting a relevant key can only cause a harmless cache miss, never a false hit. Pass dropUnknownParams: true to keep only query and the schema paths.
isProvider	predicates	Returns a predicate that checks the transport provider of the service call. Matches against 'rest', 'socketio', 'external' (any external provider), or 'server' (internal call without a provider).

See all tags for the full vocabulary.