Kernel/route middleware that authenticates the request from its Authorization: Bearer token.
If a token is present it is verified (an invalid/expired token raises AuthenticationError →
401); the verified claims are stored on the event (auth metadata) and the mapped principal
is exposed via event.getUser(). If no token is present the request continues anonymously —
enforce presence per route with requireAuth() / requireScopes().
Kernel/route middleware that authenticates the request from its
Authorization: Bearertoken.If a token is present it is verified (an invalid/expired token raises
AuthenticationError→401); the verified claims are stored on the event (authmetadata) and the mapped principal is exposed viaevent.getUser(). If no token is present the request continues anonymously — enforce presence per route withrequireAuth()/requireScopes().