# ADR 0085: Auth rules may contribute typed context

> Source: https://github.com/max-listov/stitchkit/blob/master/docs/decisions/0085-auth-rules-may-contribute-context.md

---

# ADR 0085 — Auth rules may contribute typed context

## Context

An authorization rule often resolves membership or ownership before it can
decide. Applications then duplicated the resolved fields in a handwritten scope
map, so the declared handler context could drift from the fields actually added
at runtime.

## Decision

An auth rule may return `true`, `false`, or a plain-object context contribution,
synchronously or asynchronously. `false` denies, `true` authorizes without new
fields, and an object authorizes and contributes its inferred fields. The return
type is the source for `AuthScopes` and scoped handler inference.

Before any mutation, Stitchkit validates the whole contribution. Arrays,
non-plain objects, accessors, symbols, unsafe prototypes, `__proto__`, proxies
that fail inspection, and runtime-owned context keys are rejected with a stable
framework error. A failed contribution cannot partially mutate the context.
Existing scoped `inject` uses the same merger.

## Consequences

- One resolver drives runtime authorization and handler types.
- A `false | object` rule contributes required fields; `true | object` makes
  those fields optional. Union object variants retain only their sound common
  guarantees.
- Domain roles and membership logic remain application-owned.
- Invalid legacy falsy returns other than `false` now fail instead of silently
  authorizing; this is an intentional breaking correction.