stacklok / toolhive / 23446245797

push

github

Replace webhook.Principal with auth.Identity (#4316)

* Replace webhook.Principal with auth.Identity

The webhook package defined its own Principal struct, but auth.Identity
already represents the same concept with a superset of fields. Maintaining
two parallel identity types creates sync burden and will require conversion
logic in the middleware layer. Since the webhook package has no external
consumers yet (v0.1.0), consolidate now before the API solidifies.

Closes #4315

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Introduce auth.PrincipalInfo and embed in Identity

Address review feedback on the webhook wire format: auth.Identity
carries Token, TokenType, and Metadata fields that have no business
in external webhook payloads — even redacted.

Extract the credential-free subset (Subject, Name, Email, Groups,
Claims) into auth.PrincipalInfo and embed it in Identity. This gives
structural safety: webhook.Request.Principal is now *auth.PrincipalInfo,
so tokens can never enter the webhook payload. The JSON wire format
uses "sub" with omitempty, matching the original webhook.Principal
contract from #3840.

Field access on Identity (e.g., identity.Subject) continues to work
transparently via Go embedding — only struct literals needed updating.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

22 of 22 new or added lines in 4 files covered. (100.0%)

50652 of 78510 relevant lines covered (64.52%)

90.5 hits per line