get authorization from request context

asab/api/discovery.py

@@ -20,7 +20,7 @@
 	jwcrypto = None
 
 from .. import Service
-from ..contextvars import Tenant
+from ..contextvars import Tenant, Request
 
 
 L = logging.getLogger(__name__)
@@ -401,19 +401,25 @@ def session(
 				...
 		"""
 		_headers = {}
-		if isinstance(auth, aiohttp.web.Request):
-			# TODO: This should be the default option. Use contextvar to access the request.
+
+		if auth is None:
+			# By default, use the authorization from the incoming request
+			request = Request.get(None)
+			if request is not None:
+				_headers["Authorization"] = request.headers.get("Authorization")
+
+		elif isinstance(auth, aiohttp.web.Request):
 			assert "Authorization" in auth.headers
 			_headers["Authorization"] = auth.headers.get("Authorization")
+
 		elif auth == "internal":
 			if jwcrypto is None:
 				raise ModuleNotFoundError(
 					"You are trying to use internal auth without 'jwcrypto' installed. "
 					"Please run 'pip install jwcrypto' or install asab with 'authz' optional dependency."
 				)
 			_headers["Authorization"] = "Bearer {}".format(self.InternalAuthToken.serialize())
-		elif auth is None:
-			pass
+
 		else:
 			raise ValueError(
 				"Invalid 'auth' value. "