Method requireAccountUser

internal/httpapi/scope.go:41–47

requireAccountUser is the user-returning convenience over requireAccountScope for the many account-admin handlers that only need user.ID — a clean drop-in for requireUser on operations the agent tier must not reach.

(ctx context.Context)

// for the many account-admin handlers that only need user.ID — a clean drop-in
// for requireUser on operations the agent tier must not reach.
func (s *Server) requireAccountUser(ctx context.Context) (*identity.User, error) {
	p, err := s.requireAccountScope(ctx)
	if err != nil {
		return nil, err
	}
	return p.User, nil
}

// requireAgentAccess authenticates the caller and confirms it may act as
// agentID. Account-scoped credentials may act as any agent they own (ownership