Method requireVaultAccess

internal/server/server.go:563–597

requireVaultAccess checks that the session has access to the given vault. For scoped sessions (VaultID set): checks that the session's vault matches. For instance-level sessions: resolves actor and checks the unified vault_grants table. Returns the actor (nil for scoped sessions) or writes an error

(w http.ResponseWriter, r *http.Request, vaultID string)

// For instance-level sessions: resolves actor and checks the unified vault_grants table.
// Returns the actor (nil for scoped sessions) or writes an error response.
func (s *Server) requireVaultAccess(w http.ResponseWriter, r *http.Request, vaultID string) (*Actor, error) {
	sess := sessionFromContext(r.Context())
	if sess == nil {
		jsonError(w, http.StatusForbidden, "Authentication required")
		return nil, fmt.Errorf("no session")
	}

	// Scoped session: vault is baked into the session.
	if sess.VaultID != "" {
		if sess.VaultID != vaultID {
			jsonError(w, http.StatusForbidden, "Session not authorized for this vault")
			return nil, fmt.Errorf("vault mismatch")
		}
		return nil, nil // scoped session, no actor resolved
	}

	// Instance-level session: resolve actor, check unified vault_grants.
	actor, err := s.actorFromSession(r.Context(), sess)
	if err != nil {
		jsonError(w, http.StatusForbidden, "Invalid session")
		return nil, err
	}

	has, err := s.store.HasVaultAccess(r.Context(), actor.ID, vaultID)
	if err != nil {
		jsonError(w, http.StatusInternalServerError, "Failed to check vault access")
		return nil, err
	}
	if !has {
		jsonError(w, http.StatusForbidden, "No access to this vault")
		return nil, fmt.Errorf("no grant")
	}

	return actor, nil
}

// requireVaultAdmin checks that the actor has admin role in the given vault.
// For scoped sessions: checks sess.VaultRole. For instance-level sessions: checks vault_grants.