raystack / frontier / 28435903758

44%

main: 44%

Pull #1718

github

feat(auth): enforce per-endpoint credential restrictions and make auth chain order-independent

GetPrincipal now records how a principal authenticated (Principal.AuthVia) and enforces the caller's assertion list against it, so AuthToken and the session endpoints actually restrict credential types. GetByJWT returns classifiable errors so the authenticator chain is order-independent, and the redundant opaque assertion is removed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

24 of 28 new or added lines in 4 files covered. (85.71%)

16277 of 37088 relevant lines covered (43.89%)

12.39 hits per line