> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gavai.io/llms.txt
> Use this file to discover all available pages before exploring further.
# End-user authentication
> Gate blocks by sign-in state and user role via authUser.
export const ErrorTable = ({errors}) =>
;
export const Eyebrow = ({label, tone = "default"}) =>
{label}
;
By the end of this guide your page renders different content depending on whether the visitor is signed in and which roles they hold. The `authUser` capability returns the active end-user's profile during page rendering, so you gate any block with no backend code. You will add a sign-in entry point, read the active profile, and use `visible_if` expressions to gate by auth state and by role.
## Prerequisites
A gavAI workspace.An end-user auth pool. Auth pools are provisioned automatically when you create a workspace — no extra setup.
## Steps
The integration depends on which shell your page uses:
If your page uses a **NavShell** block, sign-in may be handled by the shell's built-in auth flow.For an inline sign-in, add a **Form** block and point it at the auth flow for your pool.
The public source does not specify whether sign-in is a dedicated block type, a `NavShell` prop, or a separate built-in. Confirm with the platform team before shipping. For now, open the Builder, drag a **Form** block onto the page, and configure it under **Form → Auth settings**.
Call `authUser` from any capability hook or expression on the page. It takes no arguments and operates on the active session.
When a user is signed in, `authUser` returns a profile of this shape:
```json theme={null}
{
"user_id": "usr_01H8X3K2YQZ4V7N9P5R6S7T8U9",
"email": "ada@example.com",
"email_verified": true,
"display_name": "Ada Lovelace",
"roles": ["member", "admin"],
"metadata": { "plan": "pro" }
}
```
When no user is signed in, `authUser` returns `null`. Always handle the `null` case — every public page receives anonymous visitors.
`display_name` and `metadata` are optional fields and may be absent on some users.
Every block accepts a `visible_if` prop. Set it to an expression that evaluates to true for signed-in visitors:
```json theme={null}
{
"block": "DetailPanel",
"props": {
"schema_table": "customers",
"record_id_param": "id",
"fields": ["name", "email", "status", "notes"],
"editable": true,
"visible_if": "{{authUser != null}}"
}
}
```
When `authUser` is `null`, the block is removed from the rendered output entirely — not just hidden with CSS. Anonymous visitors never receive the markup.
The exact `visible_if` expression syntax — delimiters, operator support, and available globals — is not fully documented in the public source. The expression above is illustrative; confirm with the platform team before shipping.
Extend the `visible_if` expression to check a specific role:
```json theme={null}
{
"block": "Table",
"props": {
"schema_table": "customers",
"columns": ["name", "email", "status", "created_at"],
"sortable": true,
"filterable": true,
"page_size": 25,
"visible_if": "{{authUser.roles contains 'admin'}}"
}
}
```
Roles are workspace-defined strings. Set them in the Builder under **Workspace → Auth → Roles**. A user can hold multiple roles; the check is true if the user's `roles` array includes the named value.
Whether `contains` is the correct operator for array-membership tests in `visible_if` expressions is not confirmed in the public source. Verify with the platform team before shipping.
`visible_if` controls rendering. It is **not a security boundary**. Row-level access is enforced server-side by `runQuery` using the `authUser` context. Never rely on `visible_if` alone to protect sensitive data.
Give users a way to end their session — a button that clears the active session and redirects to the home or login page.
The exact sign-out mechanism (a capability call, a `NavShell` prop, a special Form action, or a platform-provided URL) is not specified in the public source. Confirm with the platform team. In the Builder, look for **Auth → Sign out** actions in the button and Form settings.
## Troubleshooting
## What you built
You wired a sign-in entry point, learned how `authUser` returns the active profile (or `null` for anonymous visitors), and used `visible_if` to gate blocks by sign-in state and by role. Your page now renders different content for anonymous users, signed-in members, and admins — with no custom backend.
## Next steps
Full input/output schema, null handling, and session lifecycle for the authUser capability.
How gavAI enforces workspace and row-level boundaries so one tenant never sees another's data.
The full block catalogue — every block type, its props, and how the document model works.