Method GetUserByAPIKey

internal/identity/store.go:3512–3518

GetUserByAPIKey authenticates a bearer token and returns the owning user. Rejects revoked keys and time-expired keys; touches last_used_at only on the success path so the column stays a real "last successful authentication" signal (rather than "last attempt"). Expiration semantics: expires_at IS NU

(ctx context.Context, apiKey string)

// the future, evaluated against now() in the same query so there's no
// clock skew between row read and check.
func (s *Store) GetUserByAPIKey(ctx context.Context, apiKey string) (*User, error) {
	p, err := s.GetPrincipalByAPIKey(ctx, apiKey)
	if err != nil {
		return nil, err
	}
	return p.User, nil
}

// GetPrincipalByAPIKey authenticates a bearer token and returns the full
// principal — the owning user PLUS the key's scope and bound agent (Slice 5a).