Skip to main content

Access checks live in the services, through an explicit access context

Every service method takes the acting user, agent or system as an explicit first argument and decides there whether the action is allowed; routes only authenticate. Agents, the run manager and forge webhooks call the services directly rather than over HTTP, so checks in route middleware would leave those paths unguarded.

Considered Options​

  • Checks in route middleware: rejected, because only the HTTP entry point would be protected.
  • An implicit per-request context (AsyncLocalStorage): rejected, because a missing context fails silently, while an explicit argument is enforced by the type checker and trivial to pass in tests.

Consequences​

  • A context is created per request or per run and caches what it looks up, so it must never be kept beyond that unit of work.
  • The context only answers who the actor is and what access they have; each service decides what an operation requires.
  • An actor without access gets "not found" rather than "forbidden", so nothing can be probed for existence.