Fastify plugin encapsulation limits for least-privilege authentication

Authentication Scope and Plugin Encapsulation

Implementing a least-privilege security model in Fastify often involves using preHandler hooks to restrict access to specific route groups. To maintain a clean architecture, authentication state is typically attached to the request object via decorators.

When these authentication decorators and hooks are defined within encapsulated plugin scopes, there is a tension between maintaining strict isolation and the need to share identity state across deeply nested plugins. Using the fastify-plugin wrapper can bypass this encapsulation, but this may inadvertently leak authentication contexts into scopes where they are not required.

Given the request lifecycle, there is uncertainty regarding the most efficient way to enforce granular permissions without compromising the isolation benefits of the plugin system.

• How does the use of fastify-plugin impact the ability to isolate authentication logic to specific sub-routes?
• What is the recommended approach for passing verified identity state from an onRequest hook to a nested, encapsulated plugin without making the state globally accessible?