stacklok / toolhive / 23446245797

64%

Build Type

push

github

Committed by web-flow

Commit Message

Replace webhook.Principal with auth.Identity (#4316)

* Replace webhook.Principal with auth.Identity

The webhook package defined its own Principal struct, but auth.Identity
already represents the same concept with a superset of fields. Maintaining
two parallel identity types creates sync burden and will require conversion
logic in the middleware layer. Since the webhook package has no external
consumers yet (v0.1.0), consolidate now before the API solidifies.

Closes #4315

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Introduce auth.PrincipalInfo and embed in Identity

Address review feedback on the webhook wire format: auth.Identity
carries Token, TokenType, and Metadata fields that have no business
in external webhook payloads — even redacted.

Extract the credential-free subset (Subject, Name, Email, Groups,
Claims) into auth.PrincipalInfo and embed it in Identity. This gives
structural safety: webhook.Request.Principal is now *auth.PrincipalInfo,
so tokens can never enter the webhook payload. The JSON wire format
uses "sub" with omitempty, matching the original webhook.Principal
contract from #3840.

Field access on Identity (e.g., identity.Subject) continues to work
transparently via Go embedding — only struct literals needed updating.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Run Details

22 of 22 new or added lines in 4 files covered. (100.0%)

27 existing lines in 3 files now uncovered.

50652 of 78510 relevant lines covered (64.52%)

90.5 hits per line