TanStack Start

PurposeCopy Anchor Link

permdock/tanstack-start is the server half for TanStack Start apps on React; permdock/react is the client half. middleware() and protect are TanStack Start request middleware, so the instance and the loaded row arrive as typed context in server routes and server functions.

APICopy Anchor Link

import { createPermDock } from "permdock/tanstack-start";
import { policy } from "./policy";

export const { middleware, protect, permdockHandler } = createPermDock(policy, {
  subject: (request) => userFromSession(request),
});

import { createStart } from "@tanstack/react-start";

export const startInstance = createStart(() => ({
  requestMiddleware: [middleware()],
}));

export const Route = createFileRoute("/api/posts/$id")({
  server: {
    middleware: [protect(permissions.post.update, postFromPath)],
    handlers: {
      PATCH: ({ context }) => Response.json(update(context.permdockData)),
    },
  },
});

export const Route = createFileRoute("/api/permdock")({
  server: { handlers: permdockHandler() },
});

There is no withPermDock: the middleware chain types context, so a handler after middleware() or protect reads context.permdock without a wrapper.

Request lifecycleCopy Anchor Link

permdock/tanstack-start follows the shared adapter contract. What differs on TanStack Start:

• subject, tenant, context and protect's data receive the Fetch Request. Route params are not part of it; parse them from request.url, as the example's postFromPath does.
• A loader that returns null or undefined answers 404.
• An assert error that propagates back through next() becomes the same Problem Details response as a protect refusal.
• Route beforeLoad and loader run on the client as well, so they are not a guard; guard server routes and server functions.

WhyCopy Anchor Link

TanStack Start request middleware receives the Fetch Request and passes typed context to the next step with next({ context }). The adapter returns that middleware type, so context.permdock and context.permdockData are inferred in server routes and server functions with no module augmentation and no wrapper. The entry targets @tanstack/react-start; Solid Start for TanStack would need its own peer and is not supported.

Example appCopy Anchor Link

apps/examples/tanstack-start: src/lib/permissions.ts, src/lib/policy.ts and src/lib/permdock.ts, middleware() in src/start.ts, protect on PATCH /api/posts/$id (granted) and POST /api/posts/$id/publish (denied for member), and the decision endpoint at src/routes/api/permdock.ts. src/routeTree.gen.ts is generated by pnpm dev.

Related standardsCopy Anchor Link

• Problem Details.
• AuthZEN for the decision endpoint.
• Web Bot Auth.