Route guard only, or enforced in the data layer
3 of 5 requests get through a signed-in-only guard and are refused by the data layer.
Cleo requests another tenant's document by id
read · doc-201
- Route guard only
- Returned the row
- Data layer
- 404 · looks like it doesn't exist
The page guard alone would have let this through.
Cleo, a viewer, calls the update action directly
update · doc-102
- Route guard only
- Returned the row
- Data layer
- 403 · refused
The page guard alone would have let this through.
Ben deletes a document that is not his
delete · doc-101
- Route guard only
- Returned the row
- Data layer
- 403 · refused
The page guard alone would have let this through.
Ada reads a document in her own tenant
read · doc-102
- Route guard only
- Returned the row
- Data layer
- Returned the row
Anonymous request, no session
read · doc-101
- Route guard only
- 401 · sign in
- Data layer
- 401 · sign in