Scoped Routes and Ownership

Ownership

Optional polymorphic owner fields:

• owner_type
• owner_id

Ownership can be required and fail-closed for selected endpoints.

Scoped routes

formforge.http.scoped_routes[] supports:

• name, enabled, prefix, middleware
• endpoints map
• owner config (route_param, model, route_key, type, required)
• authorization.mode: none|gate|policy
• authorization.policy
• authorization.abilities

Scoped routes duplicate package endpoints under scoped prefixes without rewriting package business logic.

This includes resolve and field-validation endpoints (/validate-field) when those endpoints are enabled in scoped route config.