identity

package
v0.7.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 9, 2026 License: MIT Imports: 1 Imported by: 0

Documentation

Overview

Package identity carries the authenticated caller identity (org + user) on the request context. It lives outside package server so the provider layer can read it without an import cycle — BYOK routing resolves per-user credentials from exactly this, never from anything client-supplied.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func With

func With(ctx context.Context, info Info) context.Context

With stamps the identity on the context.

Types

type Info

type Info struct {
	OrgID         string
	UserID        string
	APIKeyID      string
	ByokProviders []string

	// CreditsExhausted marks a request whose org wallet is at or below zero
	// (balance <= 0). The auth door only admits such requests when the org's
	// subscription is active and the balance is not negative (negative =
	// locked, refused at the door). Lanes served on the user's own BYOK keys
	// are zero-debit and proceed; any lane that would serve on memcode's keys
	// must refuse the turn instead (provider.CreditsExhaustedError).
	CreditsExhausted bool
}

Info is the verified identity of one request, stamped by the gateway's auth middleware after /api/cli/verify. ByokProviders is the presence gate: the vendors this user has an active BYOK key for (Secret Manager is consulted only for vendors listed here, so non-BYOK users cost zero secret lookups).

func From

func From(ctx context.Context) Info

From reads the identity stamped by the auth middleware. The zero Info means "not authenticated" — callers on authed paths can rely on OrgID being set.

func (Info) HasByok

func (i Info) HasByok(vendor string) bool

HasByok reports whether the user has an active BYOK key for the vendor.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL