spree-auth-permissions
Installation
SKILL.md
Contains Shell Commands
This skill contains shell command directives (!`command`) that may execute system commands. Review carefully before installing.
Spree Auth & Permissions
Spree 6 has three principals and each has its own way of being authorized:
| Principal | Authenticates with | Authorized by |
|---|---|---|
Staff (Spree.admin_user_class, default Spree::AdminUser) |
JWT (aud: admin_api) from POST /api/v3/admin/auth/login |
Permission keys held by their roles on the current store |
| Integration (server-to-server) | Secret key sk_… in X-Spree-Api-Key |
The key's scopes (same keys as roles) |
Customer (Spree.customer_class, default Spree::Customer) |
Publishable key pk_… + optional JWT (aud: store_api) |
Ownership: scoped queries plus Spree::Storefront::AccessPolicy |
Marketplace sellers are a fourth surface (/api/v3/seller, JWT aud: seller_api + X-Spree-Seller-Id) — see spree-marketplace.
Two rules sit under everything in this skill:
- Keys gate kinds of records, never which rows.
write_ordersmeans "may write orders", and the controller's scoped query (current_store.orders,current_seller.products,current_user.wishlists) decides which orders. If you add a controller, you own the scoping. - Record-state rules belong on models and workflows, not in permissions. "A placed order can't be deleted" must bind secret keys too, and secret keys never go through roles.