on

Global handler for all requests:

@auth.on
async def reject_unhandled_requests(ctx: AuthContext, value: Any) -> None:
    print(f"Request to {ctx.path} by {ctx.user.identity}")
    return False

Resource-specific handler. This would take precedence over the global handler for all actions on the threads resource:

@auth.on.threads
async def check_thread_access(ctx: AuthContext, value: Any) -> bool:
    # Allow access only to threads created by the user
    return value.get("created_by") == ctx.user.identity

Resource and action specific handler:

@auth.on.threads.delete
async def prevent_thread_deletion(ctx: AuthContext, value: Any) -> bool:
    # Only admins can delete threads
    return "admin" in ctx.user.permissions

Multiple resources or actions:

@auth.on(resources=["threads", "runs"], actions=["create", "update"])
async def rate_limit_writes(ctx: AuthContext, value: Any) -> bool:
    # Implement rate limiting for write operations
    return await check_rate_limit(ctx.user.identity)

Auth for the store resource is a bit different since its structure is developer defined. You typically want to scope store operations by rewriting the namespace to include the user's identity. The value dict is mutable — changes to value["namespace"] are used by the server for the actual operation.

@auth.on.store
async def authorize_store(ctx: AuthContext, value: Auth.types.on.store.value):
    # Automatically scope all store operations to the user's namespace.
    namespace = tuple(value["namespace"]) if value.get("namespace") else ()
    assert isinstance(namespace, tuple)
    if not namespace or namespace[0] != ctx.user.identity:
        namespace = (ctx.user.identity, *namespace)
    value["namespace"] = namespace

You can also register handlers for specific store actions:

@auth.on.store.put
async def on_put(ctx: AuthContext, value: Auth.types.on.store.put.value):
    # value has typed fields: namespace, key, value, index
    ...

@auth.on.store.get
async def on_get(ctx: AuthContext, value: Auth.types.on.store.get.value):
    # value has typed fields: namespace, key
    ...