auth-gate-alone-does-not-mean-authorization
Wrapping tRPC procedures with a protectedProcedure middleware (authentication) does not enforce authorization — any authenticated user can call any procedure on any resource. Row-level access control must be explicitly scoped: every query and mutation must filter by the caller’s userId/orgId, and role checks (admin vs member) must be enforced in the procedure body, not just at the route level. Schema-level role fields are useless unless the router actually reads them.
Related
- trpc-protected-procedure-is-not-authorization
- trpc-protected-procedure-insufficient-for-resource-authoriza
- trpc-protected-procedure-is-authn-only-not-authz
- r-same-m1-identity-complete-frontend-integration-tests
- clawteam-openclaw-multi-agent-swarm-evaluation
- schema-level-roles-without-router-enforcement-provides-no-se
- protected-procedure-is-not-row-level-authorization