Rebuild a principal from the trusted header, binding it to the tenant the DO
already authenticated. Fields are picked EXPLICITLY rather than spread, so an
attacker-supplied extra property cannot ride into DO storage or D1.
Returns undefined on anything malformed; the caller fails closed.
Rebuild a principal from the trusted header, binding it to the tenant the DO already authenticated. Fields are picked EXPLICITLY rather than spread, so an attacker-supplied extra property cannot ride into DO storage or D1.
Returns undefined on anything malformed; the caller fails closed.