feat: carry the token tag restriction on the session

server/internal/auth/middleware.go

@@ -167,9 +167,10 @@ func sessionFromToken(c *gin.Context) (*Session, bool) {
 		Role:      services.LowerRole(user.Role, tok.Role),
 		Email:     user.Email,
 		Name:      user.Email,
-		TokenID:   tok.TokenID,
-		TokenName: tok.Name,
-		Scopes:    tok.Scopes,
+		TokenID:    tok.TokenID,
+		TokenName:  tok.Name,
+		Scopes:     tok.Scopes,
+		TokenScope: tok.TagSelector,
 	}, true
 }
 
@@ -199,3 +200,14 @@ func Scopes(c *gin.Context) []string {
 // IsToken reports whether this request authenticated with an API token rather
 // than a browser session.
 func IsToken(c *gin.Context) bool { return TokenID(c) != "" }
+
+// ServerScope is the tag restriction the acting credential carries, or nil for
+// an unrestricted token and for every cookie session. Callers pass it to
+// services.ServerInTokenScope or services.IntersectSelectors — nil means the
+// whole fleet, never nothing.
+func ServerScope(c *gin.Context) map[string]string {
+	if s := GetSessionFromContext(c); s != nil {
+		return s.TokenScope
+	}
+	return nil
+}

server/internal/auth/session.go

@@ -23,13 +23,14 @@ type Session struct {
 	Email      string `json:"email"`
 	Name       string `json:"name"`
 
-	// The three fields below are set only when the request authenticated with
+	// The four fields below are set only when the request authenticated with
 	// an API token. They are never persisted to Redis — a token authenticates
 	// per request and mints no session, so a revoked token stops working
 	// immediately rather than at the end of a session TTL.
-	TokenID   string   `json:"-"`
-	TokenName string   `json:"-"`
-	Scopes    []string `json:"-"`
+	TokenID    string            `json:"-"`
+	TokenName  string            `json:"-"`
+	Scopes     []string          `json:"-"`
+	TokenScope map[string]string `json:"-"`
 }
 
 var rdb *redis.Client