// Optimisation: avoid calling userFromRequest, which acquires the state
        // lock, in case we don't need to (when endpoint is OpenAccess). This
        // avoids holding the state lock for /v1/health in particular, which is
        // not good: https://github.com/canonical/pebble/pull/369
        var user *UserState
        if _, isOpen := access.(OpenAccess); !isOpen {
                user, err = userFromRequest(c.d.state, r, ucred)
                if err != nil {
                        Forbidden("forbidden").ServeHTTP(w, r)
                        return
                }
        }

        // If we don't have a named-identity user, use ucred UID to see if we have a default.
        if user == nil && ucred != nil {
                if ucred.Uid == 0 || ucred.Uid == uint32(os.Getuid()) {
                        // Admin if UID is 0 (root) or the UID the daemon is running as.
                        user = &UserState{Access: state.AdminAccess, UID: &ucred.Uid}
                } else {
                        // Regular read access if any other local UID. 
                        user = &UserState{Access: state.ReadAccess, UID: &ucred.Uid}
                }
        }

// UserState represents the state of an authenticated API user.
type UserState struct {
        Access   state.IdentityAccess
        UID      *uint32
        Username string
}

func userString(u *UserState) string {
        if u == nil {
                return "<unknown>"
        }
        if u.Username != "" {
                return u.Username
        }
        if u.UID != nil {
                return strconv.Itoa(int(*u.UID))
        }
        return "<unknown>"
}

                user, err = userFromRequest(c.d.state, r, ucred)
                if err != nil {
                        Forbidden("forbidden").ServeHTTP(w, r)
                        return
                }