TypeScript API / laikacms/json-api / allowAll

Function: allowAll()

function allowAll(): true;

An authorization policy that permits every action for every caller.

Every build*Api requires an authorize callback — there is no implicit default, because an API that silently defaults to open is the failure mode this option exists to prevent. allowAll is the explicit way to say "this surface is intentionally unauthenticated":

const api = buildJsonApi({ repo, authorize: allowAll });

Only safe when something else guarantees the handler is unreachable by untrusted callers — a dev server bound to localhost, a test harness, or an outer middleware that has already authenticated the request. Naming it rather than inlining () => true means every deliberately-open surface in a deployment is one rg 'authorize: allowAll' away during an audit.

Returns

true