Zach Kelling 2bb69379cf Take the home org only from the boundary ...

Claims read from the identity headers fell back to X-Org-Id for the
home org whenever X-User-Owner was absent. The boundary mints
X-User-Owner for every principal it validates, so an absent one means
no validated home, and X-Org-Id is then only the org the request named.

Such claims now carry Attested, and homeOrg reads their home from
X-User-Owner alone. The JWT path, where Owner is the owner claim, is
unchanged.

Claude-Session: https://claude.ai/code/session_01HuMDfgFssPUptYUzgZ6Cp8

2026-09-27 15:01:29 -07:00

..

authz_test.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

claims_test.go

Take the home org only from the boundary

2026-09-27 15:01:29 -07:00

iammiddleware.go

Take the home org only from the boundary

2026-09-27 15:01:29 -07:00

live_test.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

orgadmin_test.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00