// Package authz answers one question for diff.sr.ht: what may a given viewer
// see. Who the viewer is, is not this package's question any more — the
// unified-login cookie is decoded by sr-ht-ecore/login, which every custom
// service on the instance shares, and a handler reads the answer with
// login.FromContext. The copy that used to live here decoded the same cookie
// and did not validate the name it found, which is the whole reason that decode
// is one package now.
//
// Authorization is delegated entirely to git.sr.ht over its internal GraphQL
// API: diff.sr.ht owns no user or repository data of its own, so there is no
// database. GQLAuthorizer issues each query as the viewing user via
// core-go's client.Do (Authorization: Internal <fernet(...)>), letting
// git.sr.ht's own loader apply visibility rules — an anonymous or unauthorized
// viewer sees a null repository, which maps to core.ErrNotFound so private-repo
// existence is never leaked. A small mutex-guarded TTL cache memoizes positive
// and not-found results (but never transport errors) to spare git.sr.ht a round
// trip on every page load.
package authz