Security

Authorization

createSearchFnServer supports a per-action authorize callback. It is called before every operation with the request context, action name, and payload:

const server = await createSearchFnServer({
  adapter,
  authorize: async (ctx, action, payload) => {
    if (action === "status") return true;
    if (action === "search" || action === "searchAll") return !!ctx.user;
    return ctx.user?.role === "admin";
  },
});

Actions

Unauthorized requests return a FORBIDDEN error envelope with no details about the denial reason.

Secret Redaction

The server automatically redacts sensitive values in structured logs. The following keys are recursively redacted:

• apiKey
• password
• secret
• token
• authorization
• connectionString

Error responses never include backend credentials, connection strings, or internal stack traces.

Credential Management

Never hardcode credentials in application code. Use environment variables at minimum, and a dedicated secret manager (AWS Secrets Manager, HashiCorp Vault, etc.) for production deployments.