fix(server): set principal_id claim on routes without an rlsModule

[pyramation]

Summary

Fixes #1439. API surfaces with no rlsModule (meta-schema routes, provisioning endpoints) returned early from the auth middleware, so req.token was never set and graphile.ts fell back to anonSettings — leaving jwt.claims.principal_id unset and breaking any SPRT policy that reads current_principal_id().

The no-rlsModule branch now attempts platform-level authentication before next():

 if (!rlsModule) {
-  return next();
+  const platformToken = await authenticatePlatform(req, pool); // constructive_auth_private.authenticate($1)
+  if (platformToken) req.token = platformToken;
+  // device-token cookie is also read on this path now
+  return next();
 }

authenticatePlatform is deliberately best-effort and never fails the request: it first probes pg_proc/pg_namespace for constructive_auth_private.authenticate (databases without the platform auth module simply proceed anonymously), then runs it through pgQueryContext with the same ip/origin/user-agent claims as the RLS path. Errors are logged at warn and the request continues anonymously rather than returning BAD_TOKEN_DEFINITION — this path must not turn provisioning traffic into 200-with-errors responses.

Credential resolution (Bearer header, falling back to the constructive_session cookie) and JWT-claim context building were extracted into resolveCredential / buildAuthContext and are shared by both paths, so cookie sessions work identically on rlsModule-less routes.

Once req.token.user_id is present, the existing graphile.ts logic sets jwt.claims.principal_id = req.token.principal_id || req.token.user_id, so no change was needed there.

Tests: graphql/server/src/middleware/__tests__/auth-no-rls-module.test.ts covers bearer + cookie population of principal_id, no-credential, missing-function, and throwing-pool cases. The first two fail on main (req.token undefined).

Link to Devin session: https://app.devin.ai/sessions/cb8b3fdcce6c4af3abb50d3401450620
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring