pub fn caller_selectors(caller: &AuthContext) -> Vec<String>Expand description
The grant selectors caller matches: a leading "*" (every caller matches it), then
"user:<email>" when caller.email is Some, then one "group:<g>" per entry in
caller.memberships. pub – shared by three consumers: flight_sql_service_impl.rs’s
CallerContext::grant_selectors, analytics-web-srv’s my_audiences handler, and the
audience-grant write policy’s per-pair hold check (which must strip the leading "*" before
binding the result – a * grant is not something a caller individually holds).