auth: make IsService/IsUser/IsMachine see through PrincipalMux

[vinaymiriyala7-gif]

Summary

The principal predicates auth.IsService and auth.IsUser are implemented to check only the default sub-principal of a knox.PrincipalMux. When a multi-provider auth chain wraps the authenticated principal in a mux via knox.NewPrincipalMux, and the default sub-principal happens to be a different type than the one the caller is trying to detect, these predicates return false even though a matching sub-principal is present.

This silently breaks any code path that gates on these predicates after auth. Concretely, the ServiceKeyCreationAuthorizer hook added in 8438e97 has the shape:

func (a *PrefixServiceKeyCreationAuthorizer) Authorize(principal knox.Principal, keyID string) (knox.Access, bool) {
    if !auth.IsService(principal) {
        return knox.Access{}, false
    }
    // ...match policies...
}

Any custom authorizer of this shape will reject every real request when the principal is a PrincipalMux whose default is a non-service principal — even when principal.GetID() returns the expected SPIFFE id and the access logger reports auth_type: "service" (that field is derived from the matched provider's name, not from IsService, so the bug is invisible from the request log alone).

Fix

• Keep the fast-path direct type assertion for callers that pass raw principal types.
• For PrincipalMux, walk mux.Principals() and return true if any constituent principal matches the target type (default and non-default alike).
• Add IsMachine for symmetry — it didn't previously exist.
• Add a Principals() accessor on knox.PrincipalMux that returns its constituent principals as []knox.Principal. The underlying field is unexported and there was no existing accessor that returned the full set; Default() only returns one and Raw() returns RawPrincipals.

Test plan

• Updated the existing TestPrincipalMuxUserOrService, which was encoding the old default-only behavior, to reflect the new "any sub-principal matches" semantics. This is a behavior change in the predicates; flagging it explicitly. The old behavior is what caused the bug above, so the assertions had to flip.
• Added TestIsServicePrincipalMux, TestIsUserPrincipalMux, TestIsMachinePrincipalMux: each wraps a single principal type in a mux and asserts only the matching predicate returns true.
• Added TestIsPredicatesRawPrincipals: asserts the fast path still works on raw (non-mux) principals.
• Added TestIsServicePrincipalMuxMixedSubPrincipals: a mux whose default is a User but which also contains a Service — IsService and IsUser both return true, IsMachine returns false. This is the exact production failure mode.
• Added TestPrincipalMuxPrincipals: verifies the new Principals() accessor returns all sub-principals.
• go test ./... — all packages pass.
• go vet ./... — clean.

Notes on scope

• No changes to Principal.Type() semantics, handler logic, the ServiceKeyCreationAuthorizer interface, or any authorizer implementation.
• No renames. The new Principals() accessor on PrincipalMux is the only API addition outside of the predicate functions themselves.

Made with Cursor