refactor(authz): require explicit authorization context at dispatch

[florishafkenscheid]

Description of change

This refactors the shared application authorization contract to make caller provenance, operation identity, resource identity, and checker configuration explicit.

The change:

• replaces Option<Actor> with Caller::{Anonymous, Actor, Internal};
• requires every command and query dispatch to identify its caller;
• replaces permission-bearing shared-kernel authorization metadata with product-neutral operation names;
• lets application contexts provide stable command/query operation names and optional resource IDs;
• includes aggregate and resource identity in authorization requests;
• requires an authorization checker during application-service construction;
• validates context-specific authorization configuration before a service starts;
• removes the implicit authorization construction path and updates existing service call sites.

This keeps the shared kernel neutral while giving downstream applications enough context for granular authorization decisions, including resource- and relationship-based checks. It also prevents missing authorization wiring from being discovered only after requests reach a running service.

How the change has been tested

The shared-kernel tests cover:

• authenticated, anonymous, and internal caller propagation;
• command and query authorization request construction;
• operation and resource identity;
• authorization denial before domain handlers execute;
• invalid context authorization configuration being rejected during service construction;
• existing command/query dispatch and error propagation.

All affected workspace call sites were updated for the explicit caller and authorization-checker contracts.

Verify the changes with:

cargo test -p shared-kernel
cargo test --workspace --all-targets

Definition of Done checklist

• I have followed the contribution guidelines for this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Summary by CodeRabbit

• New Features

  • Added caller-aware authorization for anonymous, authenticated, and internal requests.
  • Authorization checks now use stable operation names and optional resource identifiers.
  • Added authorization configuration validation with clear setup errors.
  • Expanded authorization coverage across identity, issuance, holder, library, verification, and access-token operations.
  • Added trusted internal command and query handling for workflow lookups and continuations.

• Breaking Changes

  • Application and service dispatch APIs now require an explicit caller and configured authorization checker.
  • Query integrations must provide optional resource identifiers where applicable.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c540db2a-e6d3-4cd8-91c1-27e4a57d8b90

📥 Commits

Reviewing files that changed from the base of the PR and between 90c53c3 and 7df55ed.

📒 Files selected for processing (21)

• agent_api_http/src/handlers.rs
• agent_api_http/src/v0/holder/holder/credentials/mod.rs
• agent_api_http/src/v0/holder/holder/offers/accept.rs
• agent_api_http/src/v0/holder/holder/offers/mod.rs
• agent_api_http/src/v0/holder/holder/presentations/mod.rs
• agent_api_http/src/v0/identity/connections/mod.rs
• agent_api_http/src/v0/identity/documents/mod.rs
• agent_api_http/src/v0/identity/profiles/mod.rs
• agent_api_http/src/v0/identity/services/linked_vp.rs
• agent_api_http/src/v0/identity/services/mod.rs
• agent_api_http/src/v0/issuance/credentials.rs
• agent_api_http/src/v0/issuance/offers/mod.rs
• agent_api_http/src/v0/issuance/public_offers.rs
• agent_api_http/src/v0/library/catalog/mod.rs
• agent_api_http/src/v0/library/catalog/queries/get_all_catalogs.rs
• agent_api_http/src/v0/library/catalog/queries/get_catalog_by_id.rs
• agent_api_http/src/v0/templates/mod.rs
• agent_api_http/src/v0/verification/authorization_requests.rs
• agent_shared/src/handlers.rs
• infrastructure/adapters/verification-authorization/src/lib.rs
• shared-kernel/src/authorization.rs

🚧 Files skipped from review as they are similar to previous changes (9)

• agent_api_http/src/v0/identity/services/linked_vp.rs
• agent_api_http/src/v0/verification/authorization_requests.rs
• agent_api_http/src/v0/holder/holder/credentials/mod.rs
• infrastructure/adapters/verification-authorization/src/lib.rs
• agent_api_http/src/v0/issuance/credentials.rs
• agent_api_http/src/v0/holder/holder/offers/accept.rs
• agent_api_http/src/handlers.rs
• shared-kernel/src/authorization.rs
• agent_shared/src/handlers.rs

---

📝 Walkthrough

Walkthrough

Authorization now models caller provenance, stable command and query operation names, resource identifiers, and validated checker configuration. Application services, dispatch handles, handlers, domain types, and internal workflows use the new authorization contracts.

Changes

Authorization and dispatch

Layer / File(s)	Summary
Authorization contracts shared-kernel/src/authorization.rs	Adds Caller, operation traits, resource identifiers, and context-specific checker validation.
Application service and registry shared-kernel/src/application_service.rs, shared-kernel/src/service_registry.rs	Authorization requests, envelopes, and dispatch APIs now carry Caller. Service construction validates the authorization checker.
Shared and HTTP handlers agent_shared/src/handlers.rs, agent_api_http/src/handlers.rs	Handlers require stable operation contracts and provide internal command and query wrappers.
Domain operation mappings agent_authorization/**, agent_holder/**, agent_identity/**, agent_issuance/**, agent_library/**, agent_verification/**	Commands and query views expose stable authorization operation names.
Internal caller and resource migration agent_api_http/src/v0/**, agent_identity/src/state.rs, agent_issuance/src/**, infrastructure/adapters/verification-authorization/src/lib.rs	Internal workflows use Caller::Internal. HTTP queries pass explicit resource identifiers. Tests cover caller propagation and authorization request contents.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant HTTPHandler
  participant SharedHandler
  participant ApplicationService
  participant AuthorizationChecker
  participant DomainHandler
  HTTPHandler->>SharedHandler: forward Caller, resource ID, and operation-enabled command or query
  SharedHandler->>ApplicationService: submit authorization request
  ApplicationService->>AuthorizationChecker: validate caller, resource ID, and operation
  AuthorizationChecker-->>ApplicationService: authorization result
  ApplicationService->>DomainHandler: execute authorized command or query
  DomainHandler-->>ApplicationService: return result

Loading

Suggested labels: Added

Suggested reviewers: daniel-mader

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: requiring explicit authorization context during dispatch.
Description check	✅ Passed	The description explains the authorization refactor, testing performed, and completed checklist items; the issue-links section is omitted.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/authz

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 74.66667% with 152 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
agent_identity/src/state.rs	0.00%	17 Missing ⚠️
agent_identity/src/profile/command.rs	0.00%	9 Missing ⚠️
agent_identity/src/document/command.rs	0.00%	8 Missing ⚠️
...ent_api_http/src/v0/holder/holder/offers/accept.rs	0.00%	7 Missing ⚠️
...ent_api_http/src/v0/identity/services/linked_vp.rs	0.00%	7 Missing ⚠️
agent_api_http/src/v0/library/catalog/mod.rs	93.26%	7 Missing ⚠️
...src/domain/oauth2_authorization_request/command.rs	0.00%	7 Missing ⚠️
agent_holder/src/offer/command.rs	0.00%	7 Missing ⚠️
agent_identity/src/connection/command.rs	0.00%	7 Missing ⚠️
agent_identity/src/service/command.rs	0.00%	6 Missing ⚠️
... and 23 more

Files with missing lines	Coverage Δ
agent_api_http/src/handlers.rs	100.00% <100.00%> (ø)
...tp/src/v0/issuance/credential_issuer/credential.rs	97.14% <100.00%> (ø)
...v0/issuance/credential_issuer/token_status_list.rs	98.36% <100.00%> (ø)
agent_api_http/src/v0/issuance/credentials.rs	90.45% <100.00%> (+1.47%)	⬆️
agent_api_http/src/v0/issuance/public_offers.rs	95.74% <100.00%> (+0.07%)	⬆️
agent_api_http/src/v0/templates/mod.rs	89.25% <100.00%> (+0.91%)	⬆️
agent_authorization/src/domain/client/command.rs	100.00% <100.00%> (ø)
agent_authorization/src/state.rs	78.26% <100.00%> (ø)
agent_holder/src/state.rs	0.00% <ø> (ø)
...application/credential_configuration_projection.rs	97.75% <100.00%> (ø)
... and 42 more

... and 13 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@agent_api_http/src/v0/library/catalog/mod.rs`:
- Around line 145-147: Update the catalog existence precondition in
add_templates_to_catalog and remove_templates_from_catalog to use the
actor-based query_handler path with the current actor, matching catalog reads
and duplicate_template. Replace the internal_query_handler call while preserving
the existing CatalogNotFound conversion and subsequent command authorization
flow.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4cef3d13-e8d2-44df-bc9d-a195a4d95144

📥 Commits

Reviewing files that changed from the base of the PR and between b7be938 and 90c53c3.

📒 Files selected for processing (10)

• agent_api_http/src/handlers.rs
• agent_api_http/src/v0/holder/holder/credentials/mod.rs
• agent_api_http/src/v0/holder/holder/offers/accept.rs
• agent_api_http/src/v0/holder/holder/presentations/mod.rs
• agent_api_http/src/v0/identity/connections/mod.rs
• agent_api_http/src/v0/identity/services/linked_vp.rs
• agent_api_http/src/v0/issuance/credentials.rs
• agent_api_http/src/v0/library/catalog/mod.rs
• agent_api_http/src/v0/templates/mod.rs
• agent_api_http/src/v0/verification/authorization_requests.rs