Documentation
¶
Overview ¶
Package identity carries the authenticated caller identity (org + user) on the request context. It lives outside package server so the provider layer can read it without an import cycle — BYOK routing resolves per-user credentials from exactly this, never from anything client-supplied.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Info ¶
type Info struct {
OrgID string
UserID string
APIKeyID string
ByokProviders []string
// CreditsExhausted marks a request whose org wallet is at or below zero
// (balance <= 0). The auth door only admits such requests when the org's
// subscription is active and the balance is not negative (negative =
// locked, refused at the door). Lanes served on the user's own BYOK keys
// are zero-debit and proceed; any lane that would serve on memcode's keys
// must refuse the turn instead (provider.CreditsExhaustedError).
CreditsExhausted bool
}
Info is the verified identity of one request, stamped by the gateway's auth middleware after /api/cli/verify. ByokProviders is the presence gate: the vendors this user has an active BYOK key for (Secret Manager is consulted only for vendors listed here, so non-BYOK users cost zero secret lookups).
Click to show internal directories.
Click to hide internal directories.