bearer: mint the internal authorization through internalauth
This package assembled the header by hand — json.Marshal of an auth.InternalAuth
plus "Internal " and a fernet seal — two files away from the package whose whole
purpose is to hold both ends of that handshake. It is the same drift internalauth
was hoisted to end, sitting inside the library that hoisted it: a change to the
payload shape here would have gone unnoticed by every Guard on the instance until
a revocation check started failing.
bearer: split the grant check out of validation
A sourcehut service resolves identity once per request in middleware, upstream
of the router — that is where the cookie plane and the bearer plane meet and
where a principal is put on the context — and at that point nothing knows which
route will run, so nothing knows the action. The action is known one layer down,
in the handler.
Validate insisted on both at once, which left every adopting service two bad
options: invent an action before it has one, or lift its bearer plane out of the
middleware every other plane goes through. The second is how a surface ends up
with two different ideas of who is calling.
So Inspect answers steps 1, 2 and 4 — who, what may they do, is it still live —
and Token.Authorize is step 3, asked where the action finally exists. Validate
is unchanged for callers that know both at one point.
It keeps its own ordering rather than becoming Inspect+Authorize: step 3 before
step 4 means a token that does not carry the grant is refused without a round
trip to the daemon, and a test pins that. Inspect cannot keep that ordering,
having no action to refuse on, and that is the one cost of the split — written
down at both call sites.