Users, sessions and authorization
Distinguish administration accounts, C-end users, service identities and ownership of business resources.
Who performs the operation
Administration accounts use users/roles, C-end users use Auth projects and identity directories, and service identities identify callers. Their tokens and permissions are not interchangeable.
Read the current C-end user
Use AuthSDK.getUser for a platform-verified profile, not the administrative user list. Create server clients per request and separately authorize which business resources the user owns.
TypeScript
import type { Shell } from '@mosaic-base/shell';
import type { ArticleSDK, SiteSDK, I18nSDK } from '@mosaic-base/client-sdk';
import type { AuthClient, ServerAuthClient } from '@mosaic-base/auth-sdk';
// Declare once in your application's type contract, never import SDK implementations.
declare module '@mosaic-base/shell/contracts' {
interface SdkRegistry {
'site.config': Pick<SiteSDK, 'getConfig'>;
'content.articles': Pick<ArticleSDK, 'list' | 'getBySlug' | 'getPreview' | 'search'>;
'i18n.messages': Pick<I18nSDK, 'load' | 't' | 'clearCache' | 'refresh'>;
'auth.client': AuthClient | ServerAuthClient;
}
}
export async function readRequestUser(shell: Shell) {
const auth = await shell.getSdk('auth.client');
return auth.getUser();
}
// Create the request Shell with only auth.client's Cookie policy and realmKey option.
// Dispose in the request owner. Node SDK is read-only; renewal is a writable boundary.