litestar-auth-guards

Define an async callable taking (connection, route_handler) that raises PermissionDeniedException when connection.user is missing or inactive, then attach it via the guards list on a Controller or route handler. Controller-level guards apply the policy to every handler in that controller.

Decode the Authorization header token with Token.decode using your secret key and algorithm, raising PermissionDeniedException on missing or invalid tokens. For auto-loading the user onto connection.user, use JWT middleware instead of a per-route guard.

Yes, but WebSocket handshakes cannot carry HTTP Authorization headers, so pass the JWT as a query parameter. Guards raise WebSocketException with code 4001 for auth failures and 4003 for authorization failures like missing workspace membership.

Use middleware to load the user once onto connection.user, and guards to enforce permission policies per Controller or route. Avoid guards that repeatedly query the database when middleware can load identity a single time per request.

Guards are for authentication and permission boundaries, not business validation or frontend route protection. Domain input validation belongs in handlers or services, while guards only decide whether the caller may access the resource.