Struct ClaimTenantResolver 

pub struct ClaimTenantResolver {
    pub claim_key: String,
    pub single_user_fallback: bool,
}

Reference impl: derive the tenant from an AuthContext claim.

Reads a configured claim key from AuthContext.metadata (e.g. "tenant_id", "realm", "org_id"). When single_user_fallback is true and the claim is absent, falls back to the caller’s user_id so single-user deployments map each user 1:1 to their own tenant by default.

Why single_user_fallback defaults to true

AUTHZ-DATA-S01-output Q2 leans toward the dev-safe default: a deployment without an explicit tenant_id claim should not silently serve cross-user data. Falling back to the user id means a misconfigured single-user install gets per-user isolation automatically; deployments that want a hard “claim required” gate flip the bool to false.

Fields

claim_key: String

The metadata key to look up (e.g. "tenant_id", "realm", "org_id").

single_user_fallback: bool

When the claim is absent, fall back to the caller’s user_id as the tenant value. The single-user-deployment safe default.

Implementations

impl ClaimTenantResolver

pub fn new() -> Self

Construct with the default claim key "tenant_id" and single_user_fallback = true. Matches the existing AuthContext::tenant() helper’s primary lookup key.

pub fn with_claim_key(claim_key: impl Into<String>) -> Self

Construct with a custom claim key. single_user_fallback remains at the dev-safe true default; toggle the field directly if a strict “claim required” gate is needed.

Trait Implementations

impl Clone for ClaimTenantResolver

fn clone(&self) -> ClaimTenantResolver

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ClaimTenantResolver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ClaimTenantResolver

fn default() -> Self

Returns the “default value” for a type.

impl TenantResolver for ClaimTenantResolver

fn resolve<'life0, 'life1, 'async_trait>( &'life0 self, auth: &'life1 AuthContext, ) -> Pin<Box<dyn Future<Output = Result<Tenant, TenantError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Derive the tenant for the verified caller.