mirror of
https://github.com/hanzoai/commerce.git
synced 2026-10-30 15:08:42 +00:00
zeekay
8cab81b83d
EdgeAuth set X-Org-Id, and pinned the billing subject, from the `owner` claim: the org of the application a person signed in through. Every self-serve user of the brand app therefore acted in and billed to the brand's org at a standalone commerce (COMMERCE_EDGE_AUTH=true). tenancy now resolves a verified token as cloud's SanitizeIdentity does: the home org is orgs[0], the acting org is the client's selection (X-Org-Id, or ?org on a billing path) when the signed set admits it, else the default (authz.Claims.EffectiveOrg). A program is its application's org and selects nothing; a person's token without a membership set acts in no org. The billing subject follows the acting org, and X-User-IsOrgAdmin is asked of it. orgAdminHomeMatches compared home and acting org with EqualFold; it compares them verbatim.