Who this is for#

You are building Pionia Shop. Browsing the catalog can stay public. Creating products, placing orders, and topping up a wallet should only work for the right people. This section teaches that story without jargon piles.

What you will learn#

• How login turns into a Bearer token Ada can reuse
• How to lock actions with attributes instead of copy-pasted checks
• Where secrets belong, and which guide to open next

Before you start#

How a shop request is secured#

1. Ada logs in with email/password → customer.login returns a JWT.
2. Her next call sends Authorization: Bearer ….
3. JwtAuthentication attaches her user to the request.
4. #[Authenticated] / #[Can] on the action decide if she may continue.
5. Only then does your method talk to orders or wallets.

flowchart LR
  Login["customer.login"] --> Token[JWT]
  Token --> Call["order.place + Bearer"]
  Call --> Jwt[JwtAuthentication]
  Jwt --> Attr["#[Authenticated] / #[Can]"]
  Attr --> Work[placeAction]

Suggested reading order#

A minute with Ada#

curl -s -X POST http://127.0.0.1:8000/api/v1/ \
  -H "Content-Type: application/json" \
  -d '{"service":"customer","action":"login","email":"ada@pionia.shop","password":"secret"}'

Use the returned token on protected actions. Mark product.create or order.place with #[Authenticated] so anonymous callers never reach your database code.

Common mistakes#

• Leaving one write action unprotected — prefer #[Authenticated(except: ['login', 'register'])] on CustomerService
• Storing JWT_SECRET in tracked files — use .env
• Expecting the action body to “notice” auth by itself — checks run before your method

What’s next#