./adapter/inbound/web/src/test/java/dev/caskeleton/adapter/inbound/web/security/WebSecurityContextBridgeTest.java:26: AuthenticationView authentication = ./adapter/inbound/web/src/test/java/dev/caskeleton/adapter/inbound/web/security/WebSecurityContextBridgeTest.java:27: AuthenticationView.authenticated("actor-1", Set.of("ROLE_USER"), "tenant-authenticated"); ./adapter/inbound/web/src/test/java/dev/caskeleton/adapter/inbound/web/security/WebSecurityContextBridgeTest.java:42: bridge.resolve(AuthenticationView.anonymous(), Map.of("tenant", "tenant-attacker"))) ./adapter/inbound/web/src/test/java/dev/caskeleton/adapter/inbound/web/security/WebSecurityContextBridgeTest.java:64: SecurityIdentity identity = bridge.resolve(AuthenticationView.anonymous()); ./adapter/inbound/web/src/test/java/dev/caskeleton/adapter/inbound/web/security/WebSecurityContextBridgeTest.java:75: bridge.resolve(AuthenticationView.authenticated("actor-1", Set.of("ROLE_ADMIN"))); ./adapter/inbound/web/src/test/java/dev/caskeleton/adapter/inbound/web/security/WebSecurityContextBridgeTest.java:90: new AuthenticationView( ./adapter/inbound/web/src/test/java/dev/caskeleton/adapter/inbound/web/security/WebSecurityContextBridgeTest.java:102: assertThat(AuthenticationView.class.getRecordComponents()) ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/WebSecurityContextBridge.java:16: * which is why {@link AuthenticationView} has nowhere to put a signature or a claim set. ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/WebSecurityContextBridge.java:45: public SecurityIdentity resolve(AuthenticationView authentication) { ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/WebSecurityContextBridge.java:59: AuthenticationView authentication, Map requestInput) { ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/AuthenticationView.java:24:public record AuthenticationView( ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/AuthenticationView.java:30: public AuthenticationView { ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/AuthenticationView.java:46: public static AuthenticationView anonymous() { ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/AuthenticationView.java:47: return new AuthenticationView(false, Optional.empty(), Set.of(), Optional.empty()); ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/AuthenticationView.java:51: public static AuthenticationView authenticated(String subject, Set authorities) { ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/AuthenticationView.java:52: return new AuthenticationView(true, Optional.of(subject), authorities, Optional.empty()); ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/AuthenticationView.java:56: public static AuthenticationView authenticated( ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/AuthenticationView.java:58: return new AuthenticationView(true, Optional.of(subject), authorities, Optional.of(tenantId)); ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/WebTenantContextResolver.java:27: public TenantContext resolve(AuthenticationView authentication) { ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/WebActorContextResolver.java:9: *

It takes {@link AuthenticationView} and nothing else — no request, no headers, no parameters. ./adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/security/WebActorContextResolver.java:21: public ActorContext resolve(AuthenticationView authentication) {