Auth Guard

The wrapper component's own props (beyond AuthGuardConfig).

The route/role gate you mount yourself (typically inside LoginChecker).

The single config both wrappers read.

Role names accepted for the route. By default any one of them suffices.

Claim actions accepted for the route, e.g. 'get.reports'. Matched hierarchically — a held 'get.reports' satisfies a required 'get.reports.summary'.

When true, the user must hold ALL listed roles (and ALL listed claims) rather than any one.

Row/tenant scoping applied to the claim check, e.g. { orgId: currentOrg }. A claim scoped to a concrete, differing value fails; a 'self:'-prefixed scope is treated as ownership and allowed. A claim with NO scope (null) is treated as global and satisfies any required scope — so a global/unscoped claim passes scope gating; only a claim scoped to a different value is rejected.

Hydrated from the ME response. user.isGod marks the super-admin. files holds AuthFile[] identity media (avatar etc.) from the response. isLoginChecked flips true once the first fetch resolves; isLoading is true while a fetch is in flight.

Role predicates. The isGod super-admin flag (user.isGod) short-circuits all of them to true. Note the 'godmin' ROLE does not — only isGodmin() and RoleChecker's godmin bypass honor the role; a user holding the 'godmin' role but lacking isGod is evaluated normally here.

Claim predicates with hierarchical matching and scope filtering. The isGod super-admin flag → true (the bare 'godmin' role does not short-circuit these); a failed integrity check → false (fails closed).

The combined predicate you gate UI with. RoleChecker does NOT call this — it implements the equivalent OR-combination inline via hasAnyRole/hasAllRoles/hasAnyClaim/hasAllClaims. mode 'any' (default) or 'all' switches only the CLAIMS side between any-of and all-of; roles are always any-of. When both roles and claims are passed they combine as OR. Because RouteRequirement.requireAll applies to both roles and claims, use hasAllRoles (not checkPermission) to mirror a requireAll route with multiple roles. checkPermission fails closed on an integrity-check failure: it calls verifyIntegrity() up front and returns false for its ENTIRE result when the hash is tampered — even a roles-only call like checkPermission(['admin'], []). This is asymmetric with hasRole/hasAnyRole/hasAllRoles, which are NOT integrity-gated and still answer from the (possibly mutated) roles under the same tamper.

isGodmin() reflects user.isGod or the 'godmin' role; getEffectiveUserId() returns the acting user id (the hook point for impersonation-aware UI).

Recomputes the hash of roles+claims against a closure-scoped random key generated once at module load (stable for the module lifetime). The hash itself is (re)computed and stored at hydrate. If a later recompute no longer matches (store was mutated out-of-band), claim checks return false.

Mutations beyond the predicates: hydrate(meResponse) loads identity + recomputes the integrity hash (LoginChecker calls it after the ME fetch), setLoading(bool) toggles the in-flight flag, setLoginChecked(bool) flips isLoginChecked once the ME check resolves — including the failure/retry-exhausted path, where LoginChecker calls it before redirecting to loginPath — and reset() clears user/profile/roles/claims. reset() is not automatic — call it yourself on logout to drop the cached identity.

The OR-combined role/claim predicate, for use on a button, menu item or section. Its options.mode 'all' tightens only the claims side; roles are always any-of. Note this is NOT the exact same code path routes use — RoleChecker evaluates requirements inline and its requireAll tightens both roles and claims. Like the store predicate it wraps, checkPermission fails closed on an integrity-check failure — it returns false for its ENTIRE result (including a roles-only call) when the roles/claims hash is tampered, unlike hasRole/hasAnyRole/hasAllRoles, which are not integrity-gated.

Direct predicates when you only need one axis. hasClaim takes an optional scope for row/tenant-level gating; isGodmin() returns true for a super-admin (user.isGod or the 'godmin' role). Note hasAllRoles is NOT on usePermission — it lives only on useAuthGuardStore. So the overview's advice to mirror a requireAll multi-role route with hasAllRoles must be done by reading hasAllRoles from useAuthGuardStore() directly, not from this hook.

The current identity, re-rendering consumers when it changes — isAuthenticated is true once login is checked and a user is present.