superpowers-sage:acorn-middleware

JWT authentication for Acorn routes is implemented using Bearer token validation within Acorn HTTP middleware. You need to configure a JWT_SECRET environment variable and register auth middleware in your Acorn HTTP Kernel to enforce stateless access control on protected endpoints.

Role-based authorization for Sage and Bedrock routes is handled by applying custom guards and role checks within Acorn middleware before controllers execute. The middleware verifies user roles and capabilities, automatically returning JSON 401 or 403 responses when authorization fails.

Rate limiting in Acorn is achieved by applying request filtering middleware within Acorn route pipelines. You register throttling middleware in your HTTP Kernel to deterministically preprocess requests and control traffic volume, explicitly avoiding native WordPress REST paths.

Acorn middleware supports native WordPress functions during authentication by requiring wp_set_current_user to be called within the auth middleware. This ensures WordPress user functions operate correctly inside Laravel-style middleware pipelines for JWT and guard checks.

Enforcing JSON responses on Acorn API endpoints is done by creating an EnsureJsonResponse middleware and registering it in your HTTP Kernel. This operational middleware intercepts requests within the Acorn route pipeline to guarantee consistent JSON formatting and proper HTTP status codes.

Acorn route middleware explicitly avoids intercepting native WordPress admin, template, and REST paths. It is designed exclusively for Acorn-registered HTTP routes, meaning standard WordPress requests bypass this middleware pipeline by design.