wip
Replace User with Principal
Require explicit passing of a repo for all access checks