Function authorize_access_to_conversation 

async fn authorize_access_to_conversation(
    conn: &mut PgConnection,
    chatbot_configuration_id: Uuid,
    conversation_id: Uuid,
    user: Option<AuthUser>,
    req: HttpRequest,
) -> Result<(AuthorizationToken, ChatbotTurnContext), ControllerError>

Checks that the caller may use this chatbot and that the conversation is theirs, and collects the context a turn of it needs.

Every endpoint that continues a conversation has to go through here: without the ownership comparison a caller could send messages into, or answer tool calls of, someone else’s conversation by guessing its id.