3.0.2

New: gates and policies

Say what a user may do, like "a user may edit only their own post".

Gate.define('update-post', (User user, Post post) => post.userId == user.id);
Gate.policy<Post>(PostPolicy());

await req.authorize('update', post);   // guest: 401, not allowed: 403
Route.put('/posts/{post}', [AuthMiddleware(), Can('update', param: 'post'), update]);

• Gate.allows, denies, authorize, any, all, and before / after hooks.
• GateResponse.deny('reason') sets the message of the 403.

Docs: Security → Authorization.