[mashkovd]

Refs #377 (PR-B, last slice)

Why

ParseTenantAuthzMode has refused principal since PR-A, until the pieces principal mode decides on were in place. All of them are now on main:

• principal-mode core and ADMIN_PRINCIPALS: feat(api): principal mode core for tenant authz (#377 PR-B slice 1) #595
• pid claim in local tokens, carried by refresh: feat(auth): record the principal in local OAuth tokens (#377 PR-B 2a) #598
• ZITADEL-only principals: feat(api): sign in a ZITADEL-only principal (#377 PR-B 2b) #600
• relayed and delegated callers by principal: feat(api): relay and delegate by principal (#377 PR-B 2c) #601
• non-blocking principal-keyed membership and roles: feat(gitops): read principal membership from a sync snapshot (#377 PR-B 2d) #602, fix(gitops): build the principal snapshot inside refresh #605
• session revocation on unlink: feat(auth): revoke a principal's sessions on identity unlink #604

What

• ParseTenantAuthzMode accepts principal. Every other value still refuses boot, and the error message now lists all three values.
• validatePrincipalMode (ADMIN_PRINCIPALS, principal store, principals enabled) is now reachable through validate(). TestConfigValidate_TenantAuthzMode covers it both ways: principal with an incomplete config is still refused with every kill switch, and a complete config boots.
• Docs table, package comment and helm comment updated.

What it does not do

It changes no deployment. Prod runs shadow (gitops TENANT_AUTHZ_MODE: "shadow"). The switch is a separate gitops change and waits for the shadow window (≥ 2026-10-19 ~21:35Z) and the switch criterion in docs/principals.md. B7 in gitops (wft-create-tenant writing principalId) also lands before it.

Mutation check: putting the refusal back fails TestParseTenantAuthzMode and TestConfigValidate_TenantAuthzMode.

🤖 Generated with Claude Code

https://claude.ai/code/session_0151SmHa5Uwfv9sm6G2XwDnE

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[claude]

Claude finished @mashkovd's task in 1m 23s —— View job

---

Reviewing PR #606

• Gather context (diff, CLAUDE.md)
• Analyze correctness, security, concurrency, error handling, tests
• Post findings / verdict

Reviewed git diff 36d1d73990a151592aba698eba3a55d80935fefd...3d78b4e1496388cb16d9e17817362947e44edf64.

This PR flips ParseTenantAuthzMode's principal case from refusing boot to accepting it, and updates docs/helm comments/tests to match. Verified by reading the current codebase (not just this diff) that every consumer of TenantAuthzPrincipal — tenant_role.go, router.go, oauth_handlers.go, oauth_upstream.go, oauth_signin_principal.go, tenant_authz_principal.go, validatePrincipalMode in cmd/api/main.go — was already wired up by the prior PRs referenced in the description (#595, #598, #600–#602, #604, #605), so this slice doesn't introduce new runtime logic, just removes the last gate.

No P1/P2 findings.

• Correctness: the errors import removal in tenant_authz_shadow.go is clean (no remaining errors.* use in that file); the new error message correctly lists all three accepted/rejected-elsewhere values.
• validatePrincipalMode (ADMIN_PRINCIPALS, PrincipalsDisabled, PrincipalDBConfigured) was already called from validate() for every mode; this PR just makes the mode == TenantAuthzPrincipal branch reachable, matching the PR description.
• Test coverage: TestParseTenantAuthzMode now covers principal as accepted and shadow,principal/Principal as still refused; TestConfigValidate_TenantAuthzMode covers principal with a complete config booting and an incomplete one refused via every kill switch — matches the stated mutation check.
• Docs/helm/package comments are consistent with the new behavior.

No build/test run was performed — this sandbox's Bash tool requires manual approval for go build/go test, which wasn't granted. The review above is based on static reading of the diff and the full call sites of TenantAuthzMode/validatePrincipalMode.

Verdict: APPROVE (0 P1, 0 P2, 0 P3).

[github-actions]

Antigravity (agy) review — informational

Model: gemini-3.8-flash-medium · commit 3d78b4e.

No significant issues found.

[claude]

No P1/P2 findings (0 P3). This slice only flips ParseTenantAuthzMode's principal case from refusing boot to accepting it; every consumer of TenantAuthzPrincipal was already wired up by prior PRs (#595, #598, #600-602, #604, #605). Tests, docs, and helm comments updated consistently. Good to merge.