orca/internal/engine/actor.go

// Package engine — actor.go provides the context key + helper for
// threading the audit actor (OIDC sub or SPIFFE SVID) through the
// engine layer (P04, T5; C-44). Previously the registry hardcoded
// "cli" as the actor; this lets CLI commands inject the verified
// operator identity via context so audit entries attribute actions
// to the real human/operator.
package engine

import "context"

// actorCtxKey is the context key for the audit actor.
type actorCtxKey struct{}

// WithActor returns a context carrying the audit actor. The CLI
// calls this in PersistentPreRun after resolving the OIDC sub from
// the credentials file. When the context carries no actor, the
// registry falls back to "cli" (legacy).
func WithActor(ctx context.Context, actor string) context.Context {
	if actor == "" {
		return ctx
	}
	return context.WithValue(ctx, actorCtxKey{}, actor)
}

// ActorFromCtx returns the audit actor from the context, or "cli"
// when no actor is set (legacy fallback for paths that haven't been
// wired yet).
func ActorFromCtx(ctx context.Context) string {
	if v, ok := ctx.Value(actorCtxKey{}).(string); ok && v != "" {
		return v
	}
	return "cli"
}