Struct ToolAuthorization 

pub struct ToolAuthorization<Tool> {
    acting_user_id: Uuid,
    _authorization: AuthorizationToken,
    _tool: PhantomData<fn() -> Tool>,
}

Proof that the caller was authorized for Tool before the tool ran.

Wraps the application-wide AuthorizationToken and adds the two things a chatbot tool boundary needs that a controller’s does not: which tool the check was for, as the type parameter, so a proof minted for one tool cannot be handed to another; and who was checked, so an audit row cannot name a user the check never saw. Every field is private, so authorize_tool_call is the only way to obtain one.

Fields

acting_user_id: Uuid

_authorization: AuthorizationToken

Kept only as evidence that the ordinary authorize path produced a token for this caller.

_tool: PhantomData<fn() -> Tool>

Implementations

impl<Tool> ToolAuthorization<Tool>

pub fn acting_user_id(&self) -> Uuid

The user whose permission was verified, and therefore the one an action tool must record as the actor.