Trusted context and identity
Your server maps its authenticated session to an IncldContext. The framework adapter discards browser-supplied identity fields and injects the trusted user, organization, roles, permissions, and claims.
IncldContext
interface IncldContext {
user: { id: string }
organization: { id: string }
roles?: string[]
permissions?: string[]
claims?: Record<string, unknown>
}| Field | Required | Purpose |
|---|---|---|
| user.id | Yes | Schedule owner, approval requester/approver, Audit actor/viewer, and command actor. |
| organization.id | Yes | Enforced tenant boundary for every data-plane list, lookup, mutation, history query, and idempotency key. |
| roles | No | Application-defined authorization input; @incld does not interpret role names. |
| permissions | No | Application-defined operation authorization input. |
| claims | No | Additional trusted values merged into end-user session claims. |
Resolve context from the native request
const incld = createIncld({
// ...credentials and actions
async resolveContext(request) {
const session = await sessions.fromRequest(request)
if (!session?.organizationId) return null
return {
user: { id: session.userId },
organization: { id: session.organizationId },
roles: session.roles,
permissions: session.permissions,
}
},
})
Return null
when the request is not authenticated. The proxy returns a nested
401 context_required
error. Tenant-bound operations also fail with
403 organization_context_required
when the trusted session has no organization.
Compose multiple resolvers
import { composeContext } from "@incld/client/next"
const resolveContext = composeContext(
async request => contextFromSession(request),
async request => organizationFromHost(request),
async (_request, context) => permissionContext(context),
)
Every resolver must return a fragment. A null
fragment fails closed. Roles and permissions are deduplicated; claims are merged; later user and organization values replace earlier values. The final result must contain both
user.id
and organization.id.
Derived resource identity
| Operation | Injected value |
|---|---|
| Schedule create/update | external_user_id = user.id; external_organization_id = organization.id |
| Schedule/run list | organization.id + user.id |
| Approval create/check | organization.id + requester_id = user.id |
| Approval read/decision | organization.id + participant user.id; approver_id = user.id for decisions |
| Approval cancel/revoke | organization.id + actor_id = user.id |
| Audit list/create | organization.id + viewer_id or actor_id = user.id |
| Bulk read/cancel | organization.id + actor_id = user.id |
| Session create | claims.user_id and claims.organization_id |
Identity fields from the browser are discarded
Project access is server-only