Method WWWAuthenticateChallenge

internal/agent/api.go:864–867

WWWAuthenticateChallenge is the v1-surface seam (internal/httpapi) for the RFC 6750 challenge. The legacy mux had the auth error in hand at the 401 site (writeAuthError); the v1 layer rejects via the canonical envelope and reaches this from a response wrapper that only knows the status was 401, so w

(r *http.Request)

// resolution is cheap, and routing it through the one auth path keeps the
// surfaces from diverging.
func (a *API) WWWAuthenticateChallenge(r *http.Request) string {
	_, err := a.authenticatePrincipal(r)
	return a.authChallenge(r, err)
}

// resolveAgentForUser loads an agent by email address and verifies the user owns it.
func (a *API) resolveAgentForUser(r *http.Request, email string, user *identity.User) (*identity.AgentIdentity, error) {