Auth

Identity and access belong to the platform, not the app. An app declares who its users are, with a user table it defines, and which roles they can hold. The platform verifies each person, signs and carries the session, and settles both questions at its own boundary before a method runs. App code never stores a password, mints a token, or has the final say on whether a request goes through. This namespace is the app's side of that contract: the handful of reads a method uses to know who is calling and what they are allowed to do.

Enforcement lives here, on the backend, because the frontend cannot be trusted to do it. requireRole at the top of a method refuses an unauthorized caller at the platform boundary no matter what the client sends; frontend auth state only shapes what a screen offers. Requiring a login is a null check on auth.userId. Requiring a capability is a role check with requireRole or hasRole. Roles are RBAC: declare only the ones that map to a real distinction, and remember that a freshly verified user holds none until your code assigns them.

Not every caller is a person. When the platform itself runs a method, triggered by a scheduled job, an inbound webhook, or a received email, it carries the built-in system role. requireRole('system') fences off the methods only a platform trigger should reach.