authenticate method

@override Future<Principal> authenticate(Credential credential, { required Uint8List challenge, })

Authenticates credential, returning the resolved principal.

Implementation

@override
Future<Principal> authenticate(
  Credential credential, {
  required Uint8List challenge,
}) async {
  final token = credential.token;
  if (token == null) {
    throw const AuthException('Missing token for token auth');
  }

  final grant = await repository.findByTokenHash(hashToken(token));
  if (grant == null) {
    throw const AuthException('Invalid token');
  }
  // The same rule the flag-based grants follow: a token proves *an* identity,
  // and the caller has to claim the one it actually proves.
  if (grant.principal.value != credential.principal) {
    throw const AuthException('Token does not match principal');
  }

  return Principal(id: grant.principal, roles: grant.roles);
}