code: func RemoteNode(ctx context.Context) (RemoteNodeInfo, error) {
  	// If we have a value on the context that marks this as a local
  	// request, we return the node info from the context.
  	localNodeInfo := ctx.Value(LocalRequestKey)
  
  	if localNodeInfo != nil {
  		nodeInfo, ok := localNodeInfo.(RemoteNodeInfo)
  		if ok {
  			return nodeInfo, nil
  		}
  	}
  
  	certSubj, err := certSubjectFromContext(ctx)
  	if err != nil {
  		return RemoteNodeInfo{}, err
  	}
  
  	org := ""
  	if len(certSubj.Organization) > 0 {
  		org = certSubj.Organization[0]
  	}
  
  	peer, ok := peer.FromContext(ctx)
  	if !ok {
  		return RemoteNodeInfo{}, status.Errorf(codes.PermissionDenied, "Permission denied: no peer info")
  	}
  
  	directInfo := RemoteNodeInfo{
  		Roles:        certSubj.OrganizationalUnit,
  		NodeID:       certSubj.CommonName,
  		Organization: org,
  		RemoteAddr:   peer.Addr.String(),
  	}
  
  	if isForwardedRequest(ctx) {
  		remoteAddr, cn, org, ous := forwardedTLSInfoFromContext(ctx)
  		if len(ous) == 0 || cn == "" || org == "" {
  			return RemoteNodeInfo{}, status.Errorf(codes.PermissionDenied, "Permission denied: missing information in forwarded request")
  		}
  		return RemoteNodeInfo{
  			Roles:        ous,
  			NodeID:       cn,
  			Organization: org,
  			ForwardedBy:  &directInfo,
  			RemoteAddr:   remoteAddr,
  		}, nil
  	}
  
  	return directInfo, nil
  }
docs: // RemoteNode returns the node ID and role from the client's TLS certificate.
  // If the RPC was forwarded, the original client's ID and role is returned, as
  // well as the forwarder's ID. This function does not do authorization checks -
  // it only looks up the node ID.