feat(hybridcloud): Propagate ViewerContext through cross-silo RPC

[gricha]

Pack ViewerContext into the RPC meta dict on the sending side (_send_to_remote_silo) and restore it via viewer_context_scope on the receiving side (InternalRpcServiceEndpoint).

Previously, cross-silo RPC handlers had no ViewerContext — the middleware saw RPC signature auth, not the original user. The real user identity was only available through AuthenticationContext (which most RPC calls don't pass). Now the contextvar is automatically propagated through meta, which was already reserved in the wire format for exactly this kind of use.

Backwards compatible — old callers send meta: {}, receivers treat missing viewer_context as None.

Also adds ViewerContext.deserialize() as the inverse of serialize().

Part of the ViewerContext RFC.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 542e8dc. Configure here.}

[cursor]

Deserialization error outside try block causes unhandled 500

Low Severity

ViewerContext.deserialize(vc_data) is called outside the try block (line 75), so any exception from malformed vc_data (e.g. a non-dict truthy value) produces an unhandled 500 instead of a ParseError. This contrasts with the auth_context parsing just above, which wraps AuthenticationContext.parse_obj() in its own try/except for clean error reporting. Since meta comes from the request body, a malformed viewer_context value will bypass all exception handling in the method.

 

^{Reviewed by Cursor Bugbot for commit 542e8dc. Configure here.}