Drop redundant platformUserID param from UpstreamFilter

The canonical user is already carried as principal.PlatformUserID, so the
separate platformUserID argument to FilterUpstreams was redundant. Remove it
and have consumers read principal.PlatformUserID; update the doc, the stub
filter, and the tests accordingly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: tgrunnagle

pkg/authserver/server/handlers/callback_test.go

@@ -752,12 +752,10 @@ func TestCallbackHandler_Filter_ReceivesFirstUpstreamIdentity(t *testing.T) {
 		"groups": []any{"engineering", "admins"},
 	}, filter.capturedPrincipal.Claims, "principal.Claims must carry the first upstream's claims")
 
-	// The platform user ID is the canonical (resolved) ToolHive user: non-empty,
-	// equal to principal.PlatformUserID, and distinct from the raw upstream subject.
-	assert.NotEmpty(t, filter.capturedUser, "platform user ID must be populated")
-	assert.Equal(t, filter.capturedUser, filter.capturedPrincipal.PlatformUserID,
-		"the standalone platform user ID must mirror principal.PlatformUserID")
-	assert.NotEqual(t, "user-from-provider1", filter.capturedUser,
+	// principal.PlatformUserID is the canonical (resolved) ToolHive user: non-empty
+	// and distinct from the raw upstream subject.
+	assert.NotEmpty(t, filter.capturedPrincipal.PlatformUserID, "platform user ID must be populated")
+	assert.NotEqual(t, "user-from-provider1", filter.capturedPrincipal.PlatformUserID,
 		"platform user ID is the canonical ToolHive user, not the raw upstream subject")
 }
 

pkg/authserver/server/handlers/handler.go

@@ -62,12 +62,11 @@ type Handler struct {
 //
 // FilterUpstreams receives, in order:
 //   - ctx: the request context of the first leg's callback.
-//   - platformUserID: the canonical ToolHive user ID resolved from the first
-//     upstream (the stable internal identifier; equals principal.PlatformUserID).
 //   - principal: the upstream-derived identity for authorization decisions. Its
-//     Subject is the claim-mapped upstream subject (OIDC SubjectClaim, or "sub");
-//     Claims carries the ID-token/userinfo claims; Name and Email are populated
-//     when the upstream provides them. It carries NO tokens — it is the
+//     PlatformUserID is the canonical ToolHive user ID (the stable internal
+//     identifier); Subject is the claim-mapped upstream subject (OIDC SubjectClaim,
+//     or "sub"); Claims carries the ID-token/userinfo claims; Name and Email are
+//     populated when the upstream provides them. It carries NO tokens — it is the
 //     credential-free auth.PrincipalInfo projection. The filter MUST treat
 //     principal (including its Claims map) as read-only.
 //   - configured: the names of the non-first configured upstreams, in configured
@@ -95,7 +94,6 @@ type Handler struct {
 type UpstreamFilter interface {
 	FilterUpstreams(
 		ctx context.Context,
-		platformUserID string,
 		principal auth.PrincipalInfo,
 		configured []string,
 	) ([]string, error)
@@ -278,7 +276,7 @@ func (h *Handler) computeChain(ctx context.Context, principal auth.PrincipalInfo
 		return append(chain, restNames...), nil
 	}
 
-	keep, err := h.filter.FilterUpstreams(ctx, principal.PlatformUserID, principal, restNames)
+	keep, err := h.filter.FilterUpstreams(ctx, principal, restNames)
 	if err != nil {
 		return nil, fmt.Errorf("upstream filter failed: %w", err)
 	}

pkg/authserver/server/handlers/handler_chain_test.go

@@ -32,26 +32,22 @@ var twoUpstreamChain = []string{"provider-1", "provider-2"}
 // stubUpstreamFilter is a hand-written test double for UpstreamFilter, mirroring
 // the mockIDPProvider pattern used elsewhere in this package. It records how many
 // times it was called and the arguments it was passed (the non-first upstream
-// names, the platform user ID, and the resolved principal), and returns a canned
-// keep set or error.
+// names and the resolved principal), and returns a canned keep set or error.
 type stubUpstreamFilter struct {
 	keep              []string
 	err               error
 	calls             int
 	capturedArgs      []string
-	capturedUser      string
 	capturedPrincipal auth.PrincipalInfo
 }
 
 func (f *stubUpstreamFilter) FilterUpstreams(
 	_ context.Context,
-	platformUserID string,
 	principal auth.PrincipalInfo,
 	configured []string,
 ) ([]string, error) {
 	f.calls++
 	f.capturedArgs = configured
-	f.capturedUser = platformUserID
 	f.capturedPrincipal = principal
 	if f.err != nil {
 		return nil, f.err
@@ -172,10 +168,8 @@ func TestComputeChain(t *testing.T) {
 						"filter must receive non-first configured upstreams in order")
 				}
 				if tt.wantCalls > 0 {
-					assert.Equal(t, principal.PlatformUserID, tt.filter.capturedUser,
-						"filter must receive the platform user ID")
 					assert.Equal(t, principal, tt.filter.capturedPrincipal,
-						"filter must receive the resolved principal (subject + claims) verbatim")
+						"filter must receive the resolved principal (platform user, subject + claims) verbatim")
 				}
 			}
 		})