golem-add-http-auth-ts

To add OIDC authentication to TypeScript HTTP endpoints, set `auth: true` on the `@agent()` or `@endpoint()` decorators, then configure the corresponding security scheme in your `golem.yaml` file for deployment.

Yes, you can exempt specific routes from mount-level authentication by setting `auth: false` on individual `@endpoint()` decorators, selectively allowing unauthenticated access while keeping other routes under the mount path protected.

You access the authenticated user identity by injecting a `Principal` parameter directly into your authenticated TypeScript endpoint handler, passing the verified identity context for use within your API logic.

Agent-level auth flags require authentication for every endpoint under a mount path, while endpoint-level auth flags allow granular control to protect individual routes or selectively exempt specific ones from the broader agent requirement.

Yes, you must configure the corresponding HTTP API security scheme, such as OIDC or a test header, in `golem.yaml` after enabling auth flags in code to enforce authenticated access on your deployed domain.

Your TypeScript endpoint remains accessible without authentication if the matching security scheme is not configured in `golem.yaml` for the target domain, or if the specific endpoint decorator overrides the mount-level setting with `auth: false`.