Hono context variable augmentation for fuz_app.
Cross-cutting shared vocabulary — defines the Hono ContextVariableMap
variables used by auth, http, server, and testing modules.
Auto-loaded by server/app_server.ts (side-effect import) and transitively by auth middleware modules that import CREDENTIAL_TYPE_KEY. Consumers don't need a manual import unless bypassing the standard server assembly.
6 declarations
"auth_account_id" Hono context variable name for the authenticated account id.
Set by the auth middleware (session, bearer, or daemon token) on a valid
credential. null for unauthenticated requests. The route-spec wrapper /
RPC dispatcher's authorization phase reads this when resolving the acting
actor; account-grain auth guards (require_auth) and account-grain handlers
read it directly.
"auth_api_token_id" Hono context variable name for the authenticated API token id.
"credential_type" Hono context variable name for the credential type.
readonly ["session", "api_token", "daemon_token"] The credential types that can authenticate a request — the closed set
of fuz_app builtins. The open registry on top
(create_credential_type_schema(consumer_types)) is consulted at
registry time by create_role_schema for RoleSpec.required_credential_types
validation; the wire-validated CredentialType enum here stays
narrow because middleware only ever sets one of the three builtins.
ZodEnum<{ session: "session"; api_token: "api_token"; daemon_token: "daemon_token"; }> Credential type — how a request was authenticated.
"test_context_preset" Hono context variable name for the test-harness pre-baked context flag.
Test harnesses (create_test_app_from_specs, create_fake_hono_context,
the WS round-trip connect() helper, plus per-test middleware that
pre-populates REQUEST_CONTEXT_KEY) set this to true so
apply_authorization_phase skips its DB-backed actor resolution and
trusts the supplied RequestContext. Production middleware never sets
this key — only test code does. The flag is the explicit escape hatch
that replaced the implicit "is REQUEST_CONTEXT_KEY already set?" probe,
so that future production code consulting REQUEST_CONTEXT_KEY cannot
silently bypass the live build.