semantic.auth_not_set_up

A route needs a signed-in caller, but the app declares no way for anyone to sign in.

Area 8, Sign-in and identity; not declinable; the next step is usually the human's.

Why Jadpo refuses it

Every route needs a signed-in caller unless it says authentication: RouteAuthentication.none. A caller signs in through one of the ways authentication { } declares, such as a browser session. An app that declares none has no signed-in callers, so a route that needs one would refuse every request with 401.

Jadpo won't choose the fix for you. One way makes people sign in before they reach the route, and the other opens it to anyone.

What it looks like

main.jadpo:

type Memo = Text {    max_length: 200}type AddMemo = Input {    text: Memo}action add_memo(input: AddMemo) -> Unit {    var memo: Memo = input.text    assert memo != ""}routes Memos {    prefix: /memos    POST / {        input: AddMemo        status: SuccessStatus.no_content        run: add_memo(input)    }}

   |17 |     POST / {   |     ^^^^^^ needs a signed-in caller

(human) at the end of the next: line tells your coding agent to stop and ask you which fix you want, because the choice is yours to make: it decides whether people must sign in to call POST /memos.

The error is reported once, at the first route that needs a caller, and its reason counts the others.

How to fix it

The question is whether people should sign in to use the app's routes.

If people sign in, declare who they are and how they sign in. The principal names the stored record a signed-in person is, and authentication { } lists the ways in, here a browser session kept in a cookie. In a project the principal goes in app.jadpo and authentication { } in authentication.jadpo:

principal {    user: {        subject: User.handle    }}authentication {    browser_session: {        cookie: "memo_session"    }}

POST /memos now answers callers with a valid session cookie. Anyone else gets 401 before add_memo runs. The checked project also stores the User record the principal names, and lists add_memo, which reaches no stored record, for anyone signed in under actions:.

If anyone may call the route, signed in or not, say so on the route with authentication: RouteAuthentication.none, and list add_memo for Access.public:

        authentication: RouteAuthentication.none

policy {    actions: {        add_memo: [Access.public]    }}

POST /memos answers anyone and never knows who is calling. Its input is still validated.

Related

• Routes: signed in by default
• Ways to sign in
• The principal
• Open to anyone: RouteAuthentication.none
• Permissions on actions