Auth Context

[devhawk]

Adds authentication context (authenticatedUser, assumedRole, authenticatedRoles) as a first-class concept throughout the workflow execution stack, so that identity established at the entry point is automatically carried through to child workflows, queued execution, and recovery.

New APIs:

• DBOS.authenticatedUser(), DBOS.assumedRole(), DBOS.authenticatedRoles() — static accessors to read auth context from within a running workflow
• WorkflowOptions.withAuthentication(user, roles) / .withAuthenticatedUser() / .withAssumedRole() / .withAuthenticatedRoles() — set auth when starting a workflow inline
• DBOSClient.EnqueueOptions.withAuthentication(user, roles) / .withAuthenticatedUser() / .withAssumedRole() / .withAuthenticatedRoles() — set auth when enqueueing remotely
• StartWorkflowOptions gains the same three auth fields

Propagation

• Auth fields stored in DBOSContext and carried forward when spawning child workflows (both direct invocation and startWorkflow)
• Auth fields written to the workflow status row at persist time and restored on recovery, so identity is durable across crashes
• Enqueued workflows carry auth through to dequeue and execution

[kraftp]

Shouldn't this clear the roles?

[devhawk]

yeah it should also clear assumedRole