Module context 

WAMI Context - Authentication and Authorization Context

The WamiContext carries authentication and authorization information for all WAMI operations. It is created during authentication and used throughout the system to determine:

• Which tenant and instance the operation targets
• Who is performing the operation (caller identity)
• Whether authorization checks should be applied

Security

CRITICAL: Contexts should ONLY be created through AuthenticationService.authenticate(). The builder is public for internal use and testing, but manually creating contexts bypasses authentication and is a security risk.

Proper Usage Example

This example shows how WamiContext is used in the main wami crate. In wami-core, you typically construct contexts directly using the builder:

use wami_core::arn::{TenantPath, WamiArn};
use wami_core::context::WamiContext;

// The caller ARN is the only required field: the tenant path, the instance
// and whether the caller is root are all read from it.
let context = WamiContext::builder()
    .caller_arn(
        WamiArn::builder()
            .service(wami_core::arn::Service::Iam)
            .tenant_path(TenantPath::single(0))
            .wami_instance("123456789012")
            .resource("user", "admin")
            .build()
            .unwrap(),
    )
    .build()
    .unwrap();

assert_eq!(context.instance_id(), "123456789012");
assert_eq!(context.tenant_path(), &TenantPath::single(0));
assert!(!context.is_root());

tenant_path and instance_id can still be set explicitly, but only to widen an operation beyond the caller’s own scope — cross-tenant work or impersonation. Restating them to repeat what the ARN already says is what allowed the two to drift apart.

Structs

SessionInfo

Session information for temporary credentials

Step

One link in the chain: who held authority, and how they came to hold it.

WamiContext

WAMI Context - carries authentication and authorization information

WamiContextBuilder

Builder for creating a WamiContext

Enums

Transition

How authority passed to a principal.

Constants

MAX_PROVENANCE_DEPTH

How many times authority may pass hands within one context.