CoSecCallerResolver

The caller of a request from the security context CoSec's pipeline built for it: CoSec authenticates the request and resolves its scope, deciding it itself or, behind a CoSec gateway (cosec.pipeline.mode=gateway), reading what the gateway verified from CoSec-Identity. This resolver turns that context into a Caller.

• Unauthenticated: no security context, one CoSec's pipeline did not build (it has no scope), or an anonymous principal, is no caller: the edge answers 401.

• Tenant: the security context's; CoSec's default tenant (0) is CoSecCallerOptions.defaultTenant.

• Owner and subject: the principal's id, the subject always. The owner is the principal's id for an owner-level caller, and none for a tenant-level one (CoSecCallerOptions.tenantRoles, CoSecCallerOptions.tenantPolicies), such as an employee who ships every buyer's orders: the parts absent from a caller's scope are not checked.

• Space: the space of CoSec's scope, which CoSec validated (CoSec-Space-Id, a space the principal has a role in); its default space is none. Wow-Space is not read: on a CoSec host the client names its space to CoSec.

• Application (Caller.app): the app of CoSec's scope, the one CoSec evaluated the request in: the host's (cosec.authorization.scope.app-id), or the one the request declared (CoSec-App-Id) and CoSec accepted, or, behind a gateway, the one the gateway forwarded. None when the scope names no app.

• Cross scope: CoSecCallerOptions.crossScopeRoles and CoSecCallerOptions.crossScopePolicies.

• Never a service identity: a service names itself on the internal port (Wow-Service), never through CoSec, so no principal asserts a synchronous call's root command, whatever headers its request carries.

• Attributes: the principal's roles in its scope (ROLES), its policies (POLICIES), and every other attribute of the principal under its own name, the claims an access policy reads (caller.claims("departments")); a value is a list, an array or a comma-separated string. An attribute named as one of those the caller holds already (ROLES, POLICIES, Caller.APP) is not a claim: CoSec's roles, policies and application win.