Replaces request.user deliberately, bypassing the single-write guard.
This is the framework's authoritative identity write: auth-plugin's
authMiddleware calls it, because a global registration plus a route-level
one is a supported composition and both runs must be allowed to write. An
application performing step-up authentication or impersonation calls it for
the same reason — the boundary the guard draws is explicit intent versus
implicit assignment, not one write per request.
Replaces
request.userdeliberately, bypassing the single-write guard.This is the framework's authoritative identity write:
auth-plugin'sauthMiddlewarecalls it, because a global registration plus a route-level one is a supported composition and both runs must be allowed to write. An application performing step-up authentication or impersonation calls it for the same reason — the boundary the guard draws is explicit intent versus implicit assignment, not one write per request.Safe to call on a request that was never sealed.