Guards

type AuthGuard struct{ tokens *Tokens }

func (g *AuthGuard) CanActivate(ec dygo.ExecutionContext) (bool, error) {
    tok, ok := strings.CutPrefix(ec.HTTP().Request().Header.Get("Authorization"), "Bearer ")
    if !ok {
        return false, errs.Unauthorized("missing bearer token") // 401
    }
    u, ok := g.tokens.Lookup(tok)
    if !ok {
        return false, nil // 403 Forbidden resource
    }
    ec.SetContext(context.WithValue(ec.Context(), userKey{}, u)) // the handler's ctx sees it
    return true, nil
}

// Global, with DI, like APP_GUARD:
dygo.Provide(NewAuthGuard, dygo.Group(dygo.AppGuards))