feat(context): introduce GroupRequest and ContextGroupId types for group management

crates/auth/src/auth/service.rs

@@ -59,6 +59,14 @@ impl AuthService {
         self.token_manager.verify_token_from_headers(headers).await
     }
 
+    /// Return the `public_key` field stored for `key_id`, if any.
+    ///
+    /// Used by the server auth guard to inject the authenticated identity into
+    /// request extensions so handlers can use it as the effective requester.
+    pub async fn get_key_public_key(&self, key_id: &str) -> Result<Option<String>, AuthError> {
+        self.token_manager.get_public_key_for_key_id(key_id).await
+    }
+
     /// Authenticate a token request
     ///
     /// This method authenticates the user using the provided token request

crates/auth/src/auth/token/jwt.rs

@@ -419,6 +419,19 @@ impl TokenManager {
         Ok(())
     }
 
+    /// Return the `public_key` field stored for a given `key_id`, if any.
+    pub async fn get_public_key_for_key_id(
+        &self,
+        key_id: &str,
+    ) -> Result<Option<String>, AuthError> {
+        let key = self
+            .key_manager
+            .get_key(key_id)
+            .await
+            .map_err(|e| AuthError::StorageError(e.to_string()))?;
+        Ok(key.and_then(|k| k.public_key))
+    }
+
     /// Refresh a token pair using a refresh token
     ///
     /// This method verifies the refresh token and generates new tokens based on the key type.