permissions-procedure

Add the @RequiresPermission('<resource>:<action>') decorator to the procedure class alongside @Injectable() and @ConnectProcedure(). The interceptor checks the right before the procedure body runs, so no check belongs inside handle.

Use @PublicProcedure('<reason>') for guests without sign-in, @OptionalAuthProcedure('<reason>') when a guest is allowed but a token is read if present, and @RequiresAuth('<reason>') for any signed-in person. The reason argument is only for code readers.

The interceptor answers Code.Unauthenticated when a sign-in is missing where one is needed, and Code.PermissionDenied when the user is signed in but lacks the right. Procedures unknown to the interceptor are also denied by default.

A procedure must carry exactly one access declaration. Adding two decorators on one procedure prevents the application from coming up, and the failure only surfaces at startup, so keep a single declaration per procedure.

Declare the menu item and address once in the single declaration the header and guard read from. An item with a flag is declared without rights or address; once a screen exists, remove the flag and add the rights.

Never check rights inside handle, because the interceptor enforces access before the body runs. Also avoid hanging a guard on a whole protected route group, since it runs once per page load and misses moves between sections.