refactor(authz): move scoped access control enricher after authz step - #23847

@@            Coverage Diff             @@
##           master   #23847      +/-   ##
==========================================
- Coverage   52.61%   52.57%   -0.04%     
==========================================
  Files        2836     2836              
  Lines      177975   177975              
==========================================
- Hits        93640    93572      -68     
- Misses      76142    76190      +48     
- Partials     8193     8213      +20     

Flags with carried forward coverage won't be shown. Click here to find out more.

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Summary by CodeRabbit

• Improvements

  • Authorization-related context is now populated with user-scope details after authorization, keeping those details aligned with the authorization outcome. This may affect information available to downstream processing after access checks.

• Compatibility

  • No changes to public declarations were reported.

The gRPC server now registers the authorization-trace enricher as a post-auth context enricher. The comment now describes user-scope injection after authorization.

Changes: Authorization trace

Layer / File(s)	Summary
Post-auth enricher registration central/main.go	The authorization-trace enricher is registered as a post-auth context enricher instead of a pre-auth context enricher. The comment now describes injecting user scope after authorization.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Refactor

Suggested reviewers: ajheflin

Merge Risk: Minimal · up to 7adcc

The interceptor move matches the stated authorization flow and is ready to merge.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title states the main change: the scoped access control enricher moves after the authorization step. The raw summary confirms central/main.go appends the authorization-trace enricher to PostAuthCo…
Description check		The description explains the reason for the change. Current authorizers do not use scoped access control rules from the context, and future scoped access control may need role information that the aut…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title states the main change: the scoped access control enricher moves after the authorization step. The raw summary confirms central/main.go appends the authorization-trace enricher to PostAuthContextEnrichers instead of PreAuthContextEnrichers. The title is specific and matches the changeset. It uses the conventional refactor(authz) prefix and is 69 characters long.

Full details: Description check

Explanation

The description explains the reason for the change. Current authorizers do not use scoped access control rules from the context, and future scoped access control may need role information that the authorization step fetches, so the interceptor moves in the gRPC chain. The User-facing documentation and Testing and quality sections are filled in. The automated testing section states that existing CI should cover the change. The How I validated section only says 'In CI we trust,' which gives no concrete validation steps. The CI results checkbox is unchecked. The 'change me!' placeholder was replaced in the Description section but not in the template's required structure, and the author did not explain which validation was performed beyond CI.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR