6. Customers and staff
Until now anyone could call POST /orders, and say they were anyone: the customer was a field in
the request. In this chapter Shopfront learns who is asking. A customer signs in and places orders
as themselves, reads their own orders and nobody else's, and a member of staff reads every order
but cannot place one.
This chapter starts from the end of chapter 5.
In this chapter
- Fail closed
- Packages
- Roles and a development signing key
- Who may run PlaceOrder
- A customer reads their own orders
- Sign in, and run trains as the caller
- Try it
- What it refuses
- Test it
SDK Reference
AddTraxJwtAuth | TraxAuthorize | TraxPrincipal | ITrainExecutionService | Scope a data context to the caller | Effect data testing
Next: 6.1 Fail closed