Annotation Interface RequiresAccess
Marks a CloudForge Manager REST controller method as requiring only that the caller pass
Manager's baseline access check — no specific
policy and no resolved
caller identity beyond that. Read-only endpoints use this: the request
must be authenticated (session cookie, ALB/application OIDC, or a personal access token), but
the method body has no need for a Caller value and enforces nothing beyond that.
Enforced by AuthorizationInterceptor against
com.cloudforgeci.manager.web.AccessGuard#requireAccess. Every method on a Manager
@RestController must carry exactly one of RequiresAccess, RequiresCaller,
RequiresPolicy, or RequiresAdmin — enforced at build time by
ControllerAnnotationCoverageTest so a forgotten annotation fails the build instead of
silently leaving an endpoint unguarded.