Method resolvePrincipal

internal/httpapi/httpapi.go:435–447

resolvePrincipal runs the injected auth path. It prefers the scope-aware PrincipalAuthenticator; if only the legacy Authenticator is wired it treats the caller as account-scoped (pre-Slice-5a behavior — no scope ceiling).

(r *http.Request)

// PrincipalAuthenticator; if only the legacy Authenticator is wired it treats
// the caller as account-scoped (pre-Slice-5a behavior — no scope ceiling).
func (s *Server) resolvePrincipal(r *http.Request) (*identity.Principal, error) {
	if s.deps.PrincipalAuthenticator != nil {
		return s.deps.PrincipalAuthenticator(r)
	}
	if s.deps.Authenticator == nil {
		return nil, fmt.Errorf("authentication unavailable")
	}
	u, err := s.deps.Authenticator(r)
	if err != nil {
		return nil, err
	}
	return &identity.Principal{User: u, Scope: identity.ScopeAccount}, nil
}