Validate a principal AND bind it to the tenant that is about to act on it.
tenantId on a decoded principal crosses an authentication boundary exactly
as ApprovalActor.tenantId does — the type says string, and the type system
has no authority over a value read back out of D1 or a DO's storage.
Returns the canonical snapshot, not the argument: the tenant that was
compared and the tenant the caller goes on to use are then the same string.
Validate a principal AND bind it to the tenant that is about to act on it.
tenantIdon a decoded principal crosses an authentication boundary exactly asApprovalActor.tenantIddoes — the type saysstring, and the type system has no authority over a value read back out of D1 or a DO's storage.Returns the canonical snapshot, not the argument: the tenant that was compared and the tenant the caller goes on to use are then the same string.