Struct Provenance 

pub struct Provenance {
    pub trace: TraceContext,
    pub tenant: Option<Arc<TenantConfig>>,
    pub claims: Option<Arc<Claims>>,
    pub session: Option<Arc<Session>>,
}

Who/where/why for one unit of work — identical shape across transports.

Fields

trace: TraceContext

W3C trace identity: continued from the caller/producer, or a fresh root.

tenant: Option<Arc<TenantConfig>>

Resolved + validated tenant (None = unknown without fallback, or suspended — callers must treat suspended as a hard cut-off).

claims: Option<Arc<Claims>>

Decoded principal claims (JWT / signed cookie), when presented.

session: Option<Arc<Session>>

Server-side session, when the session pipeline matched a cookie.

Implementations

impl Provenance

pub async fn from_headers( headers: &HeaderMap, container: &FrozenDiContainer, ) -> Self

HTTP requests: headers carry everything.

This is the ONE place trace + tenant + credentials meet a header map.

pub fn from_ws_handshake( headers: &HeaderMap, query: Option<&str>, container: &FrozenDiContainer, ) -> Self

WebSocket handshakes: headers, plus ?access_token=<jwt> from the URL.

Identical to Provenance::from_headers except for that one extra credential source — browsers cannot set headers on new WebSocket(url), so without it no browser can authenticate a handshake at all. The query token is only consulted when no header/cookie credential is present, and it decodes through the same access-JWT path, so the claims a gateway sees are the same either way. See extract_claims_ws.

No server-side session is loaded: a WS connection authenticates once at upgrade and holds its identity for the life of the socket.

pub fn from_message(msg: &InboundMessage, container: &FrozenDiContainer) -> Self

Consumer-mesh messages: the producing request’s identity rides the envelope. The tenant id is validated against the SAME registry as HTTP — a suspended tenant’s queued events resolve to None and stop being processed — and the producer’s traceparent continues the distributed trace instead of starting an orphan root.

Messages authenticate at the transport (broker credentials), not per event, so claims/session are absent by design.

pub fn traceparent(&self) -> String

traceparent for stamping outbound hops (HTTP calls, outbox rows, queue envelopes).