Method requireUser

internal/httpapi/httpapi.go:404–410

requireUser authenticates the caller or returns a 401 envelope carrying the machine-branchable "unauthorized" code.

(ctx context.Context)

// requireUser authenticates the caller or returns a 401 envelope carrying
// the machine-branchable "unauthorized" code.
func (s *Server) requireUser(ctx context.Context) (*identity.User, error) {
	p, err := s.requirePrincipal(ctx)
	if err != nil {
		return nil, err
	}
	return p.User, nil
}

// requirePrincipal authenticates the caller and returns the full principal
// (user + scope + bound agent), or a 401 envelope. The scope-aware basis for