Method resolveAgentAccessToken

internal/agent/agent_identity.go:159–186

resolveAgentAccessToken verifies an e2a-minted access_token JWT and resolves it to an agent-scoped principal. Returns (nil, false, nil) when the bearer is not one of our JWTs (so the caller can fall through to API-key/OAuth paths); returns an error only when it IS our JWT but fails verification or l

(r *http.Request, bearer string)

// not one of our JWTs (so the caller can fall through to API-key/OAuth paths);
// returns an error only when it IS our JWT but fails verification or lookup.
func (a *API) resolveAgentAccessToken(r *http.Request, bearer string) (*identity.Principal, bool, error) {
	if !a.agentAuthReady() || !looksLikeJWT(bearer) {
		return nil, false, nil
	}
	claims, err := a.signer.VerifyToken(bearer, agentauth.TypAccessToken, a.agentAuthIssuer())
	if err != nil {
		// It parses as a JWT but isn't a valid e2a access token — reject
		// rather than fall through (a tampered/expired token is a 401, not an
		// API-key probe).
		return nil, true, errors.New("invalid agent access token")
	}
	ag, err := a.store.GetAgentByID(r.Context(), claims.Subject)
	if err != nil || ag == nil {
		return nil, true, errors.New("agent not found for access token")
	}
	// Kill switch, re-checked per request (the agent row is already loaded, so
	// this is free): a bumped assertion_version invalidates outstanding access
	// tokens immediately rather than only starving new mints — revocation is
	// instant, not bounded by the 15-min token TTL.
	if ag.AssertionVersion != claims.AssertionVersion {
		return nil, true, errors.New("access token revoked (stale assertion_version)")
	}
	user, err := a.store.GetUserByID(r.Context(), ag.UserID)
	if err != nil || user == nil {
		return nil, true, errors.New("owner not found for access token")
	}
	return &identity.Principal{User: user, Scope: identity.ScopeAgent, AgentID: ag.ID}, true, nil
}

// looksLikeJWT is a cheap pre-filter: a compact JWS is three base64url segments
// separated by dots and (for our RS256 tokens) starts with the "eyJ" header.