Real accounts, without the password problem.

# end users: people who sign up on your app
[auth]
enabled   = true
providers = ["email"]  # codes; passkeys ride along

# each person sees only their own rows
[db.tables.books]
read  = "own"
write = "own"

import { db } from 'hatchable';

export const access = 'user';
export const methods = ['POST'];

export default async function (req, res) {
  // req.user is guaranteed here. Anyone signed
  // out was turned away before this ran.
  await db.query(
    'INSERT INTO books (user_id, title) VALUES ($1, $2)',
    [req.user.id, req.body.title]
  );
  res.json({ ok: true });
}