Identify the current token
Authenticate with an operator token or an app API key or a signed-in Foliot Console session.
What the presented token is: an operator’s name, an app’s id, or a signed-in person with the workspaces they belong to and their role in each. For a person this is read from the database on every call, never from the token. A person who has been invited is let in first: when the server has the email service configured, it asks it which addresses that person has verified and joins them to every workspace with a pending invitation for one of those addresses, whatever else they already belong to (at most about once every 15 seconds for a person with no workspace and once every 10 minutes for one with a workspace, and never failing this call if the service cannot be reached).