// Package authz answers two orthogonal questions for compare.sr.ht: who is
// making a request, and what may they see. Identity is derived purely from the
// SourceHut unified-login cookie (sr.ht.unified-login.v1), a Fernet token
// encrypted with the instance [sr.ht] network-key; UsernameFromRequest decrypts
// it and yields a bare username, or "" for an anonymous viewer. It never
// rejects a request — an unreadable or absent cookie simply means anonymous.
//
// Authorization is delegated entirely to git.sr.ht over its internal GraphQL
// API: compare.sr.ht owns no user or repository data of its own, so there is no
// database. GQLAuthorizer issues each query as the viewing user via
// core-go's client.Do (Authorization: Internal <fernet(...)>), letting
// git.sr.ht's own loader apply visibility rules — an anonymous or unauthorized
// viewer sees a null repository, which maps to core.ErrNotFound so private-repo
// existence is never leaked. A small mutex-guarded TTL cache memoizes positive
// and not-found results (but never transport errors) to spare git.sr.ht a round
// trip on every page load.
package authz