Struct Caller 

pub struct Caller {
    pub org_id: i64,
    pub org_public_id: String,
    pub user_id: Option<Uuid>,
    pub role: OrgRole,
    pub is_platform_user: bool,
    pub is_internal: bool,
}

Auth context passed from API handler to service layer.

Replaces raw org_id: i64 parameter on service methods. Carries all information needed for policy evaluation.

Fields

org_id: i64

Internal organization ID (for database queries).

org_public_id: String

External organization public ID.

user_id: Option<Uuid>

Authenticated user ID (None for API key auth without user context).

role: OrgRole

User’s role in the organization.

is_platform_user: bool

Whether the caller is a platform user (email allowlist).

is_internal: bool

Whether the caller originates from an internal server path.

Implementations

impl Caller

pub fn internal(org_id: i64) -> Self

Create an internal/platform caller with Owner role.

Used for gRPC service calls (worker ↔ server) and other internal operations that should bypass all policy checks.

THREAT[TM-AUTHZ-002]: This constructs an Owner / is_internal caller that bypasses ALL policy evaluation for the given org_id. The worker control plane builds it from the CLIENT-SUPPLIED req.org_id on every RPC, so a single valid worker bearer token can act on ANY org — there is no per-org token scoping. The full tenant-isolation guarantee on the worker boundary therefore rests on (1) network isolation of that boundary (it MUST never be reachable from untrusted networks) and (2) the shared worker secret, which is constant-time compared in the gRPC auth interceptor. Only ever call this from trusted gRPC/internal paths.

Trait Implementations

impl Clone for Caller

fn clone(&self) -> Caller

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Caller

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.