Method AuthenticatePrincipal

internal/agent/api.go:683–685

AuthenticatePrincipal is the scope-aware seam (Slice 5a): same credential resolution as AuthenticateUser, but returns the full principal (user + scope + bound agent) so the v1 layer can enforce the hard scope ceiling. There is still exactly one place credentials are checked.

(r *http.Request)

// + bound agent) so the v1 layer can enforce the hard scope ceiling. There is
// still exactly one place credentials are checked.
func (a *API) AuthenticatePrincipal(r *http.Request) (*identity.Principal, error) {
	return a.authenticatePrincipal(r)
}

// authenticateUser is the user-only convenience over authenticatePrincipal,
// retained for the legacy mux handlers (OAuth / session auth) that do not enforce the v1 scope ceiling.