feat: ship agent-first mission control v0.2.57

backend/Services/RequestAuthorizationHelper.cs

@@ -4,36 +4,62 @@ namespace Nexus.Api.Services;
 
 public static class RequestAuthorizationHelper
 {
-    public sealed record AgentHeaderResolution(string? AgentId, bool HeaderProvided, bool IsRecognized);
+    public sealed record AgentHeaderResolution(
+        string? AgentId,
+        bool HeaderProvided,
+        bool IsRecognized,
+        bool CredentialVerified,
+        bool IdentityHintAuthorized);
 
     public static bool IsAuthenticatedService(HttpContext httpContext, IConfiguration configuration) =>
-        httpContext.User.IsInRole("Service") || HasValidServiceKey(httpContext, configuration);
+        (httpContext.User.Identity?.IsAuthenticated == true &&
+         httpContext.User.IsInRole("Service")) ||
+        HasValidServiceKey(httpContext, configuration);
+
+    public static bool HasVerifiedAuthentication(HttpContext httpContext, IConfiguration configuration) =>
+        httpContext.User.Identity?.IsAuthenticated == true ||
+        HasValidServiceKey(httpContext, configuration);
 
     public static bool IsPrivilegedUser(HttpContext httpContext) =>
         httpContext.User.Identity?.IsAuthenticated == true &&
         (httpContext.User.IsInRole("owner") || httpContext.User.IsInRole("admin"));
 
+    public static bool CanUseAgentIdentityHint(HttpContext httpContext, IConfiguration configuration) =>
+        IsAuthenticatedService(httpContext, configuration) ||
+        IsPrivilegedUser(httpContext);
+
     public static async Task<string?> ResolveAllowedAgentHeaderAsync(
         HttpContext httpContext,
         IAgentService agentService,
+        IConfiguration configuration,
         CancellationToken ct)
-        => (await ResolveAgentHeaderAsync(httpContext, agentService, ct)).AgentId;
+        => (await ResolveAgentHeaderAsync(httpContext, agentService, configuration, ct)).AgentId;
 
     public static async Task<AgentHeaderResolution> ResolveAgentHeaderAsync(
         HttpContext httpContext,
         IAgentService agentService,
+        IConfiguration configuration,
         CancellationToken ct)
     {
         var headerValue = httpContext.Request.Headers["X-Agent-Id"].FirstOrDefault();
         if (string.IsNullOrWhiteSpace(headerValue))
-            return new AgentHeaderResolution(null, HeaderProvided: false, IsRecognized: false);
+            return new AgentHeaderResolution(
+                null,
+                HeaderProvided: false,
+                IsRecognized: false,
+                CredentialVerified: HasVerifiedAuthentication(httpContext, configuration),
+                IdentityHintAuthorized: CanUseAgentIdentityHint(httpContext, configuration));
 
         var allowed = AgentIdentityCatalog.BuildAllowedActorIds(await agentService.GetAllowedAgentIdsAsync(ct));
         var normalized = AgentIdentityCatalog.NormalizeActorId(headerValue, allowed);
+        var credentialVerified = HasVerifiedAuthentication(httpContext, configuration);
+        var identityHintAuthorized = CanUseAgentIdentityHint(httpContext, configuration);
         return new AgentHeaderResolution(
-            normalized,
+            identityHintAuthorized ? normalized : null,
             HeaderProvided: true,
-            IsRecognized: normalized is not null);
+            IsRecognized: normalized is not null,
+            CredentialVerified: credentialVerified,
+            IdentityHintAuthorized: identityHintAuthorized);
     }
 
     public static bool HasValidServiceKey(HttpContext httpContext, IConfiguration configuration)