Method AuthenticateUser

internal/agent/api.go:671–677

authenticateUser extracts and validates the bearer credential from the request, returning the owning user. Dispatch is by token prefix: - ate2a_ → OAuth access token (fosite-validated via the configured provider). Rejected if missing, revoked, expired, or the provider isn't wired. - anything else

(r *http.Request)

// resolution path (API key, OAuth bearer, session cookie) instead of
// forking a second one. There is one place credentials are checked.
func (a *API) AuthenticateUser(r *http.Request) (*identity.User, error) {
	p, err := a.authenticatePrincipal(r)
	if err != nil {
		return nil, err
	}
	return p.User, nil
}

// AuthenticatePrincipal is the scope-aware seam (Slice 5a): same credential
// resolution as AuthenticateUser, but returns the full principal (user + scope