auth.requireRole
Throws 401 if the caller is not signed in, 403 if they hold none of the listed roles: the first line of a gated method.
auth.requireRole(...roles) → void
The gate at the top of a protected method: it throws 401 when there is no signed-in user and 403 when the user holds none of the listed roles, so an unauthorized caller never reaches the code below. Multiple roles read as OR. This is the enforcement the frontend cannot be trusted to do, and it is how you fence off platform-only methods, with requireRole('system') for a method that should run only from cron, a webhook, or inbound email. Reach for auth.hasRole instead when you want to branch rather than block.
Parameters
roles
string[]
RequiredAny-of role ids.
Gate a method
export async function approve(input) { auth.requireRole('admin', 'approver'); // ... }