# `Dialup.Auth.Grants`
[🔗](https://github.com/SouichiroTsujimoto/Dialup/blob/main/lib/auth/grants.ex#L1)

Helpers for scoping MCP grants based on authentication state.

Unauthenticated sessions receive minimal read-only capabilities. After login,
pages should extend this base grant with role-specific capabilities in
`agent_grant/1`.

# `for_user`

```elixir
@spec for_user(
  map(),
  keyword()
) :: map()
```

Returns guest grant when `current_user` is absent, otherwise `logged_in_grant/1`.

Pages can pass extra capabilities to merge when authenticated:

    def agent_grant(assigns) do
      Dialup.Auth.Grants.for_user(assigns, capabilities: [:add_item])
    end

# `guest_grant`

```elixir
@spec guest_grant() :: map()
```

Base grant for unauthenticated sessions (agent-first / pre-login).

# `logged_in_grant`

```elixir
@spec logged_in_grant(
  map() | struct(),
  keyword()
) :: map()
```

Default authenticated grant; override capabilities via opts.

---

*Consult [api-reference.md](api-reference.md) for complete listing*