guard

type Decision struct {
	// Allowed reports whether the event may reach the handler.
	Allowed bool
	// Reason is reported to the caller when the event is refused, and should say
	// what is missing without saying what would satisfy it.
	Reason string
	// Identity is the authenticated principal, reached from a handler through
	// [IdentityFrom]. Nil when the guard authorises without identifying.
	Identity any
	// Claims are the verified token claims, when the guard verified a token.
	Claims map[string]any
}

type Guard func(ctx context.Context, req *Request) (Decision, error)

type Request struct {
	Kind    handler.Kind
	Method  string
	Route   string
	Headers handler.Params
	Query   handler.Params
	// ConnectionID is set for WebSocket events.
	ConnectionID string
	SourceIP     string
	RequestID    string
}