Jobs And Tests

Authorization is often easiest to use when you already have an explicit actor.

That is common in jobs, queues, tests, and service code.

Jobs

import authorization from '@holo-js/authorization'

export async function runPublishJob(postId: string, actor: { id: string, role: string }) {
  const post = await Post.findOrFail(postId)

  await authorization.forUser(actor).policy('posts').authorize('update', post)

  await post.publish()
}

Passing the actor explicitly keeps the job deterministic. It does not depend on request context or auth state. Use .policy('posts') to select the posts policy explicitly. If you omit it, the default policy resolution will be used.

Tests

import authorization from '@holo-js/authorization'

await expect(
  authorization.forUser({ id: 'user-1', role: 'editor' }).policy('posts').authorize('update', post),
).resolves.toBeUndefined()

await expect(
  authorization.forUser(null).policy('posts').authorize('update', post),
).rejects.toThrow()

Use explicit actor tests when you want the authorization rule itself under test, not the request stack.

What to prefer

• Call authorization.forUser(user) when the actor is already known.
• Invoke authorization.guard('web') or top-level helpers only when you want auth to resolve the actor for you.
• Enable standalone mode in tests when you want to avoid booting auth.

Continue

• Standalone Mode
• Auth Integration
• 403 Vs 404