RBAC

import { requireRole } from '@restjs/auth'
 
app.delete('/users/:id', authenticate(jwt), requireRole('admin'), handler)
app.get('/reports', authenticate(jwt), requireRole(['admin', 'manager']), handler)

import { requirePermission } from '@restjs/auth'
 
app.post('/posts', authenticate(jwt), requirePermission('posts:create'), handler)
// 'admin:*' matches 'admin:read', 'admin:write', etc.

import { requireOwnership } from '@restjs/auth'
 
app.get('/users/:id/profile', authenticate(jwt), requireOwnership('id'), handler)
// Admins bypass ownership check