Foresight.HTTP.RequestContext.DefaultResolver (Foresight v0.1.0)

Copy Markdown View Source

Resolves a request into a tenancy Context, and is the authorization authority.

Two credential classes:

  • Service (admin) — the presented bearer equals the configured service key. A service caller may assert x-foresight-role / x-foresight-prefix headers (still constrained by any auth.tenant_scopes allowlist). This is the ops / test impersonation path.

  • Tenant — any other presented bearer. Its role is resolved from the tenant-key registry keyed on (tenant_id, api_key), and its schema prefix is resolved from the TenantLifecycle ledger keyed on tenant_id. Client-supplied x-foresight-role / x-foresight-prefix headers are ignored for tenant callers — this is what prevents a client from asserting another tenant's role.

Anything that resolves to neither a valid service credential nor a registered tenant key is rejected (401). There is no silent downgrade to a broader scope.