The name of the public collection.
The public action type. Only read is supported.
OptionalintegrationId: stringThe ID of the integration containing the collection. Defaults to the built-in database.
// Anyone can read the `articles` collection, but only authors can write to it.
@publicCollection('articles', 'read')
export class ArticleService extends SquidService {
@secureCollection('articles', 'write')
async secureArticlesWrite(context: MutationContext): Promise<boolean> {
return this.isAuthenticated();
}
}
Class decorator that declares reads from a collection as intentionally public.
Public reads bypass security-rule evaluation entirely: Core serves them without calling backend code, so any client can read the collection, including unauthenticated ones. Use it only for data that is safe to expose to everyone; prefer a
@secureCollectionread rule when access must depend on the caller.Only reads can be made public. Writes always go through their security rules, so a public-read collection can still restrict
insert/update/delete/writewith@secureCollection.Secure wins on conflict: if a
@secureCollectionor@secureDatabaseread (orall) rule also applies to the same collection, that rule takes precedence at runtime and the public declaration is ignored.