Expand description
Second built-in payload strategy: api.authorization.context-pair@1.
This strategy derives a matched control/candidate pair that varies only the authorization context of an otherwise identical request, so a strategy-aware capability executor can measure how the same resource’s visibility differs between an anonymous and an authorized principal.
The control leg is deliberately empty: an empty artifact instructs the HTTP
executor to omit the authorization header entirely, representing the
anonymous context. The candidate leg is the seed verbatim — the complete
authorization header value the host wants to test (for example
Bearer <token>). Derivation is a pure function of (role, seed) — no
clocks, randomness, knowledge state, or transport.
The strategy only accepts header-safe seed bytes and never introduces control characters, so a derived candidate is always a valid header value and cannot perform header injection or request splitting at the derivation boundary.
Structs§
- ApiAuthorization
Context Pair Strategy - Second built-in
PayloadStrategy: an anonymous/authorized context pair.
Constants§
- API_
AUTHORIZATION_ CONTEXT_ PAIR_ HEADER_ NAME - Request header this revision varies. The candidate leg applies the derived artifact as this header’s value; the control leg omits it.
- API_
AUTHORIZATION_ CONTEXT_ PAIR_ ID - Stable identity of this strategy, without its revision.
- API_
AUTHORIZATION_ CONTEXT_ PAIR_ REVISION - Deterministic implementation revision materialized by this module.