io:user

Syntax

<meta io:user=example.com>
<meta io:user="alice@example.com example.org">
<meta io:user=*>
<script type=worker edge io:user=example.com>
  export default { fetch: () => new Response('ok') }
</script>

The attribute can go on any element. <meta> is the usual choice, and an edge worker script can carry it too.

Value

A space-separated list of permits. Each permit is one of these:

person@domain.tld

That exact account.

domain.tld

Any account whose email domain is exactly that domain. example.com matches a@example.com, but not a@mail.example.com.

*

Any signed-in user. It never matches an anonymous visitor, who is asked to sign in instead.

An empty value

An empty or whitespace-only value. Only the owner and the editors pass, but the attribute still switches its gate on.

self Experimental

Accepted and dropped at deploy time, so io:user=self has the same effect as an empty value: only the owner and the editors pass.

Description

io:user is the source gate of a deployment. The source is the full authored page that ? opens in RTCode.io. When a deployment has source rules, only the owner, the editors and the accounts matching an io:user permit may open it.

The permits of every io:user element add up: the ones on ordinary elements and the ones on edge worker scripts. The attribute is read when you deploy. It does not restrict who may view the deployment: use edge:user for that.

Usage notes

When the source is private

The source is public unless the deployment has one of these:

• an io:user element without io:guest, other than an edge worker;
• an edge:user element without edge:guest;
• at least one <script type=worker edge> where not every edge worker carries io:guest.

With any of these in place, the owner and the editors can always open the source, and io:user permits add more accounts. Without one, anyone can open it, signed in or not.

It does not grant viewing

An account that io:user lists but edge:user does not can open the source with ?, but cannot view the deployment. Source access and view access are separate gates. edge:user permits give no source access either. See how the two gates combine.

Cancel it with io:guest

io:guest on the same element cancels that element's io:user. A separate <meta io:user>, or any edge:user, keeps the source private even when your edge workers carry io:guest. See io:guest.

Edge workers

An edge worker without io:guest makes the source private on its own, and io:user on the worker script adds accounts to the list of people who may open it. io:user permits are collected from every edge worker script of the deployment.

What visitors see

See ?.

Matching

Permits match by exact email, by exact domain (the text after @) or with *, which means any signed-in user. Subdomains do not match. Permits are lower-cased when you deploy, so write them, and the Editors entries, in lower case. See Permits.

At deploy time

The permits are compiled into the deployment's access rules when you deploy, and the attribute is removed from the served HTML. It stays in the authored source. To change who may open the source, edit the attribute and deploy again.

Examples

Open the source to a team

<meta io:user=example.com>
<h1>A public page with a private source</h1>
<p>Anyone can view this page. Only example.com accounts, the owner and the editors can open its source.</p>

Deploy it, then open the page with ? appended. A signed-in @example.com account reaches the editor. Anyone else is turned away.

Add teammates to a worker deployment

<script type=worker edge io:user="alice@example.com bob@example.com">
  export default { fetch: () => new Response('Hello') }
</script>

The edge worker has no io:guest, so the source is private. io:user lists who may open it besides the owner and the editors.

Combine with edge:user

<meta edge:user="example.com alice@example.org">
<meta io:user=example.com>
<h1>Team page</h1>

Signed-in @example.com accounts and alice@example.org can view the page. Only @example.com accounts, the owner and the editors can open the source, so Alice can view the page but not open ?.

Specifications

Not part of any specification. io:user is an RTCode.io and RTEdge.net attribute. The 403 response uses the status code of:

Availability

See also

• Security and access model
• Restricting access
• io:guest
• edge:user
• Global attributes
• ?
• <script type=worker>