Method requirePrincipal

internal/httpapi/httpapi.go:415–430

requirePrincipal authenticates the caller and returns the full principal (user + scope + bound agent), or a 401 envelope. The scope-aware basis for the hard scope ceiling (requireAccountScope / requireAgentAccess).

(ctx context.Context)

// (user + scope + bound agent), or a 401 envelope. The scope-aware basis for
// the hard scope ceiling (requireAccountScope / requireAgentAccess).
func (s *Server) requirePrincipal(ctx context.Context) (*identity.Principal, error) {
	// The rate-limit middleware may have already authenticated this request
	// on the read path; reuse that principal instead of hitting auth twice.
	if p := principalFromContext(ctx); p != nil {
		return p, nil
	}
	r := RequestFromContext(ctx)
	if r == nil {
		return nil, NewError(http.StatusInternalServerError, "internal_error", "authentication unavailable")
	}
	p, err := s.resolvePrincipal(r)
	if err != nil {
		return nil, NewError(http.StatusUnauthorized, "unauthorized", "authentication required")
	}
	return p, nil
}

// resolvePrincipal runs the injected auth path. It prefers the scope-aware
// PrincipalAuthenticator; if only the legacy Authenticator is wired it treats