cloudflare-toolkit

Appearance

@adrianhall/cloudflare-toolkit

@adrianhall/cloudflare-toolkit / lib/hono / PathPolicy

Interface: PathPolicy ​

Defined in: src/lib/auth-internal/types.ts:40

A single path-matching rule used to decide whether a request requires authentication.

Policies are evaluated in order; the first match wins.

Properties ​

audience? ​

optional audience?: string

Defined in: src/lib/auth-internal/types.ts:74

Application Audience Tag required for this specific path. Only meaningful when authenticate is true.

A matched policy's audience overrides the consumer's top-level CloudflareAccessOptions.audience/CloudflareAccessPluginOptions fallback for that request — it does not merge with it. This lets one middleware instance protect several path-prefixed Cloudflare Access applications on the same hostname, each with its own Audience Tag, instead of validating every protected path against a single flat allowlist (which would let a token minted for one application pass audience validation on another application's routes).

When omitted on an authenticated policy, the top-level fallback audience is used instead — see CloudflareAccessOptions.audience's security remarks for what omitting both means.

authenticate ​

authenticate: boolean

Defined in: src/lib/auth-internal/types.ts:47

true - the matching path requires authentication. false - the matching path is public / anonymous.

pattern ​

pattern: RegExp

Defined in: src/lib/auth-internal/types.ts:42

Regular expression tested against the request pathname.

redirect? ​

optional redirect?: boolean

Defined in: src/lib/auth-internal/types.ts:58

Controls the response when an unauthenticated request hits this path in a consuming dev-emulation layer (e.g. cloudflareAccessPlugin):

  • true (default) — redirect to a login form. Appropriate for page routes where the browser should navigate to a login UI.
  • false — return 401 instead of redirecting. Appropriate for API routes.

Only meaningful when authenticate is true.