How user identity works in ExApps

In B-03 you used nc.user in your FastAPI endpoints to get the current user's ID. This section explains what's actually happening under the hood.

When a request comes in through the AppAPI proxy, AppAPI:

1. Reads the session cookie from the browser request to identify the logged-in Nextcloud user
2. Validates that the user is active and has permission to access the ExApp
3. Adds the AUTHORIZATION-APP-API header containing the user ID and shared secret
4. Forwards the request to your FastAPI server

AppAPIAuthMiddleware unpacks this header, validates the secret, and makes the user ID available. nc_app() — the FastAPI dependency you use with Depends(nc_app) — constructs a NextcloudApp instance authenticated as that user. nc.user then simply reads the user ID from that authenticated context.

This is why nc.user is always a non-empty string in your endpoints — if there's no valid user session, AppAPI returns 401 before your code ever runs.

nc.user returns the Nextcloud login name — a plain string like alice or bob. Not a numeric ID, not a display name. This is exactly what gets stored in your user_id database column.