3 people 89a7c70a89 A member subscribes only their own account, and the edge strips every authority header ...

A card subscription took any in-org userId, so a member could open a plan for
another member and pay with that member's credits or balance. A caller who is
not an org admin, SuperAdmin or service now subscribes their own account
whatever userId names; the org's own account stays its admins'.

EdgeAuth's strip list is authz.Headers plus authz.Retired, so X-User-IsOrgAdmin
and X-Billing-Account-Id can no longer be set by a client; X-User-IsOrgAdmin is
minted only from a verified token whose own org the request acts in.

Every site the ecosystem rule decides has a test that fails under the old
prefix rule, including red's repro tests.

Co-authored-by: Hanzo Dev <[email protected]>

2026-09-23 21:54:41 -07:00

..

iammiddleware

Only an org's admins subscribe the org's own account

2026-09-23 21:54:41 -07:00

oauthmiddleware

Hanzo Commerce

2026-09-23 21:52:16 -07:00

accesstoken_test.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

accesstoken.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

account.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

admin.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

basicauth.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

cache.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

cors.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

edgeauth_test.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

edgeauth.go

A member subscribes only their own account, and the edge strips every authority header

2026-09-23 21:54:41 -07:00

error_test.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

error.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

errorstatus_test.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

logger.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

login.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

method.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

middleware.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

mint_once_test.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

mint_test.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

mint.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

notfound.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

organization.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

overrides.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

platformonly_test.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

platformonly.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

platformread.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

red_edgeauth_orgadmin_test.go

A member subscribes only their own account, and the edge strips every authority header

2026-09-23 21:54:41 -07:00

static.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

unavailable.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00

user.go

Hanzo Commerce

2026-09-23 21:52:16 -07:00