pub async fn require_leader(
__arg0: Auth,
req: Request<Body>,
next: Next,
) -> ClResult<Response<Body>>Expand description
Owner/leader gate. Must be layered after require_auth, which installs Auth.
Delegated credentials — share links and apkg-publish tokens — are rejected
before the role check: tenant API keys are minted with the full owner role set
regardless of their scopes column, so a role test alone would let one through.
Capability scopes (carddav:* / caldav:*) are deliberately not rejected here —
crate::scope::scope_permits already constrained them fail-closed in
require_auth, and a second rejection would 403 a DAV key on its own routes.