[shark0F0497]

Summary

Fix Keystone service calls to Hilbert after Hilbert began requiring an explicit Tenant principal for authenticated business APIs.

Motivation

Keystone staging currently authenticates successfully with Hilbert Digest AK/SK, but workspace and DC plan synchronization receives 403 tenant_principal_required. Hilbert now requires the service identity to select its authorized Tenant before calling business endpoints.

Changes

• Select Hilbert Tenant 1 through POST /v1/console/tenant/select using Digest authentication.
• Cache the returned opaque Tenant principal per HilbertClient.
• Attach X-Tenant-Principal and X-Tenant-ID: 1 to subsequent Hilbert service requests.
• Serialize initial principal acquisition so concurrent callers only select the Tenant once.
• Add coverage for Tenant selection, header propagation, principal caching, and authorization failure.
• Update existing Hilbert client tests to provide a preselected principal when testing isolated API contracts.

Type of Change

• Bug fix
• Test changes

Preconditions

Hilbert must assign the Keystone service identity an active authorization for Tenant 1. Without that server-side authorization, /v1/console/tenant/select correctly continues to return tenant_authorization_unavailable.

Testing

• go test ./...
• go vet ./...
• git diff --check

Impact

• No API changes to Keystone clients.
• Hilbert Tenant ID is intentionally fixed to 1 for the current deployment model.
• The principal is cached for the process lifetime; restarting Keystone reacquires it.