Implements Casbin authorization middleware for Qwik framework with support for HTTP Basic Authentication, custom auth methods, and extensible authorizer interface.

Implementation

• Core middleware (src/authz.ts): Qwik RequestHandler that enforces Casbin policies based on user, path, and HTTP method
• BasicAuthorizer: Extracts username from HTTP Basic Auth header or event.sharedMap for custom auth flows
• Authorizer interface: Allows custom authorization logic while maintaining Casbin integration
• TypeScript types: Full type definitions for @builder.io/qwik-city integration

Usage

import { newEnforcer } from 'casbin';
import { authz } from 'qwik-authz';

const enforcer = await newEnforcer('model.conf', 'policy.csv');

// Basic usage
export const onRequest = authz({ newEnforcer: enforcer });

// Custom auth (JWT/OAuth)
export const onRequest = async (event) => {
  event.sharedMap.set('username', await verifyToken(event));
};
export const onGet = authz({ newEnforcer: enforcer });

// Custom authorizer
class MyAuthorizer implements Authorizer {
  async checkPermission(): Promise<boolean> {
    // Custom logic + Casbin enforcement
  }
}
export const onRequest = authz({ 
  newEnforcer: enforcer, 
  authorizer: MyAuthorizer 
});

Testing & CI

• 17 unit tests covering authentication modes, authorization flows, and error cases
• GitHub Actions workflow: lint → test + coverage → semantic-release
• Node.js 24 LTS, triggers on push/PR to master
• Apache 2.0 headers (2026) on all source files

• Fixes [feature] add the code for qwik-authz #1

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.