the auth of the logged in user. AuthMiddleware and Auth.setUser set it. It is not in the input (query and body), so a client field can not set it.
AuthMiddleware
Auth.setUser
@override IAuth? auth;