authorization

<%# private stream: turbo signs the serialized record name %>
<%= turbo_stream_from current_user %>

<section class="notifications">
  <h1>Notifications</h1>

class Document < ApplicationRecord
  belongs_to :owner, class_name: "User"
  has_many :visibilities, class_name: "DocumentVisibility", dependent: :delete_all

  scope :public_documents, -> { where(is_public: true) }

# app/policies/post_policy.rb
class PostPolicy < ApplicationPolicy
  class Scope < Scope
    def resolve
      if user.admin?
        scope.all

class Comment < ApplicationRecord
  belongs_to :account
  belongs_to :author, class_name: "User"

  validates :body, presence: true

module DangerousAction
  extend ActiveSupport::Concern

  FRESH_WINDOW = 10.minutes

  class ConfirmationMismatch < StandardError; end

module ApplicationCable
  class Connection < ActionCable::Connection::Base
    identified_by :current_user

    def connect
      self.current_user = find_verified_user

const jwt = require('jsonwebtoken');

const SECRET = process.env.JWT_SECRET;
const ALGORITHM = 'HS256';
const ACCESS_TTL = '15m';

<?php

use App\Http\Controllers\DocumentsController;
use Illuminate\Support\Facades\Route;

Route::middleware('auth')->group(function () {

<?php

namespace App\Models\Scopes;

use App\Support\TenantContext;
use Illuminate\Database\Eloquent\Builder;

class SnipPolicyScope
  def initialize(member, relation = Snip.all)
    @member = member
    @relation = relation
  end

import { cookies } from "next/headers";
import { jwtVerify } from "jose";

export interface Session {
  userId: string;
  role: "user" | "admin";

import { Injectable, signal, computed } from '@angular/core';

export interface CurrentUser {
  id: string;
  email: string;
  roles: string[];