aravind changes

go-api/internal/orgctx/orgctx.go

@@ -1,14 +1,17 @@
 // Package orgctx carries the organization a request operates on.
 //
-// Phase 2C has no authentication, so there is nothing to derive a tenant from.
-// Rather than defaulting org_id deep inside the SQL — where it would have to be
-// unpicked from fourteen repositories once auth arrives — the value is put on
-// the request context by one middleware and threaded explicitly through the
-// service and repository boundaries.
+// It predates authentication. Before there was a session to derive a tenant
+// from, org_id was put on the request context by one middleware rather than
+// defaulted deep inside the SQL, so that it would not have to be unpicked from
+// fourteen repositories later. That handover has since happened: the
+// authenticate middleware in httpserver reads the organization off the user's
+// row, and authctx.Identity.OrgID is what the service and repository layers
+// actually read.
 //
-// When authentication lands, DevMiddleware is replaced by one that reads the
-// organization off the authenticated session. Nothing below this package
-// changes: every caller already takes an org id as a parameter.
+// What is still load-bearing here is DevOrgSlug and DevOrgName, which name the
+// organization the seeder creates. With and From remain the read/write pair for
+// the context key the middleware still sets; retiring them in favour of
+// authctx.Identity.OrgID alone is a deliberate change, not a tidy-up.
 package orgctx
 
 import (