starter code

internal/api/whoami.go

@@ -0,0 +1,22 @@
+package api
+
+import (
+	"net/http"
+)
+
+// Whoami echoes the resolved principal. The cheapest possible end-to-end test
+// of the auth chain: if this returns your key id and scopes, then the bearer
+// header, the checksum, the hash lookup, the status checks and the rate limiter
+// are all working.
+func Whoami() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		p := PrincipalFrom(r.Context())
+
+		WriteJSON(w, http.StatusOK, map[string]any{
+			"key_id":     p.KeyID,
+			"owner_id":   p.OwnerID,
+			"scopes":     p.Scopes,
+			"quota_tier": p.QuotaTier,
+		})
+	})
+}