Auth and Client Route Hook

Put shared access rules in package.json and exceptional navigation in app/middleware.

Automatic login and Role routing

true requires login, a string requires one Role, and a string array accepts any listed Role.
false creates a public exception inside a broader protected pattern. Runtime applies the most specific path first.
Page rules redirect unauthenticated users to /login and Role mismatches to /403. Use the login and denied keys to change those defaults.
/api rules run through auth.require on the server and return 401 or 403.
List the page and the actual API path separately in the same auth object. Runtime does not guess which API a page calls.
Do not create app/middleware/login.hook.ts or server/hooks/login.hook.ts for ordinary login checks.

// package.json
{
  "auth": {
    "/account/*": true,
    "/api/account/*": true,
    "/admin/*": "admin",
    "/api/admin/*": ["admin", "owner"],
    "/admin/health": false
  }
}

Exceptional page navigation

Use app/middleware only for exceptional client navigation unrelated to login or Roles.
Execute *.hook.ts in app/middleware and subfolders in ascending order of file name.
Use config.active and config.path to control whether and where the Hook runs.
Return undefined to continue, false to cancel, or a string or Cake20 View Router path object to redirect.

// app/middleware/leave.hook.ts
export const config = {
  path: "/editor/*"
};

export default () => {
  if (store.editor.dirty) return false;
};

Preview and detailed permissions

package.json auth provides shared first-level access control on the frontend and server. Check ownership, HTTP methods, and data-specific permissions inside each API with auth.require.
Design Preview and Template Preview skip frontend auth routing and Route Hooks so protected screens remain visible.
Preview prepass checks server auth rules with the Roles of the first user in app/preview/User.json, keeping protected sample responses aligned with production rules.
Hook files are also imported and checked for grammar in every UI build, so incorrect code is Build errors are reported in the same way in preview and production builds.