Security And Access

Vyasa security is route-aware rather than content-export oriented: the live app decides whether a request should pass, redirect to login, or stop with 403 before the page is rendered. The core checks are assembled in make_user_auth_before(), with config coming from VyasaConfig.get_google_oauth() and VyasaConfig.get_rbac(). This guide is about how to think about auth in a live Vyasa site, not how to build a generic identity system. The important distinction is between "who may log in" and "which paths those people may read."

What You Can Turn OnURL copied

auth_required = true

[google_oauth]
client_id = "REPLACE_ME"
client_secret = "REPLACE_ME"
allowed_domains = ["example.com"]

[rbac]
enabled = true
default_roles = ["reader"]

Local username/password auth and Google OAuth can coexist on the same login page. RBAC then maps users to roles and roles to path patterns through resolve_roles() and is_allowed().

Why The Split ExistsURL copied