feat(auth): support reverse-proxy driven proxy auth

Closes HP-353.

app/layout/app.tsx

@@ -4,6 +4,7 @@ import { ErrorBanner } from "~/components/error-banner";
 import StatusBanner from "~/components/status-banner";
 import { isDataUnauthorizedError } from "~/server/headscale/api/error-client";
 import { usersResource } from "~/server/headscale/live-store";
+import { isUserPrincipal } from "~/server/web/auth";
 import { Capabilities } from "~/server/web/roles";
 import log from "~/utils/log";
 
@@ -33,16 +34,15 @@ export async function loader({ request, context }: Route.LoaderArgs) {
   try {
     const { principal, api } = await context.apiForRequest(request);
 
-    const user =
-      principal.kind === "oidc"
-        ? {
-            email: principal.profile.email,
-            name: principal.profile.name,
-            picture: principal.profile.picture,
-            subject: principal.user.subject,
-            username: principal.profile.username,
-          }
-        : { name: principal.displayName, subject: "api_key" };
+    const user = isUserPrincipal(principal)
+      ? {
+          email: principal.profile.email,
+          name: principal.profile.name,
+          picture: principal.profile.picture,
+          subject: principal.user.subject,
+          username: principal.profile.username,
+        }
+      : { name: principal.displayName, subject: "api_key" };
 
     // MARK: The session should stay valid if Headscale isn't healthy
     const isHealthy = await context.headscale.health();
@@ -51,8 +51,9 @@ export async function loader({ request, context }: Route.LoaderArgs) {
         await api.apiKeys.list();
       } catch (error) {
         if (isDataUnauthorizedError(error)) {
-          const displayName =
-            principal.kind === "oidc" ? principal.profile.name : principal.displayName;
+          const displayName = isUserPrincipal(principal)
+            ? principal.profile.name
+            : principal.displayName;
           log.warn("auth", "Logging out %s due to expired API key", displayName);
           return redirect("/login", {
             headers: {
@@ -64,7 +65,7 @@ export async function loader({ request, context }: Route.LoaderArgs) {
 
       // Self-heal: if the linked Headscale user was deleted, clear the
       // stale link so the user gets prompted to re-link.
-      if (principal.kind === "oidc" && principal.user.headscaleUserId) {
+      if (isUserPrincipal(principal) && principal.user.headscaleUserId) {
         try {
           const usersSnap = await context.hsLive.get(usersResource, api);
           if (!usersSnap.data.some((u) => u.id === principal.user.headscaleUserId)) {