On this page
Use env.MINIUP_USER
env.MINIUP_USER represents the trusted current Site member inside a Site Members Function. Use this public Function runtime contract for authorization and personalization instead of trusting user or role values sent by the browser.
Read MINIUP_USER identity fields
| Field | Meaning |
|---|---|
id | The current member’s user identifier |
email | The member’s email information, when available |
name | The member’s display name, when available |
role | The member’s Site role: owner, admin, editor, or viewer |
siteId | The linked MiniUp Site identifier |
The identity is supplied for Site Members Functions. Do not assume a Public or API Key Function receives a member identity. Display names and email addresses should not be treated as durable business authorization keys.
Use identity in a Function
- Link the Function to your Site with Site Members access.
- Read
env.MINIUP_USERinside the request handler. - Check the role and, where necessary, the record’s relationship to
user.id. - Return only the user information the frontend needs.
export default {
async fetch(request, env) {
const user = env.MINIUP_USER;
if (!user) return Response.json({ error: "Sign in required" }, { status: 401 });
return Response.json({
user: { id: user.id, name: user.name || "Member", role: user.role }
});
}
};Do not trust browser-supplied identity
A request body such as {"role":"owner"} is just user input. It does not change env.MINIUP_USER.role or grant permission. Use the trusted identity for every protected operation, even when the frontend previously loaded a bootstrap response.