Send ssh_certificates as protocol

When a user is authenticated via SSH certificates, let's
send a different protocol rather than simple `ssh`

internal/gitlabnet/accessverifier/client.go

@@ -13,8 +13,9 @@ import (
 )
 
 const (
-	protocol   = "ssh"
-	anyChanges = "_any"
+	sshProtocol     = "ssh"
+	sshCertProtocol = "ssh_certificates"
+	anyChanges      = "_any"
 )
 
 type Client struct {
@@ -87,11 +88,15 @@ func (c *Client) Verify(ctx context.Context, args *commandargs.Shell, action com
 	request := &Request{
 		Action:        action,
 		Repo:          repo,
-		Protocol:      protocol,
 		Changes:       anyChanges,
+		Protocol:      sshProtocol,
 		NamespacePath: args.Env.NamespacePath,
 	}
 
+	if args.Env.NamespacePath != "" {
+		request.Protocol = sshCertProtocol
+	}
+
 	if args.GitlabUsername != "" {
 		request.Username = args.GitlabUsername
 	} else if args.GitlabKrb5Principal != "" {

internal/gitlabnet/accessverifier/client_test.go

@@ -266,14 +266,17 @@ func setup(t *testing.T, userResponses, keyResponses map[string]testResponse) *C
 					_, err := w.Write(tr.body)
 					require.NoError(t, err)
 					require.Equal(t, namespace, requestBody.NamespacePath)
+					require.Equal(t, sshCertProtocol, requestBody.Protocol)
 				} else if tr, ok := userResponses[requestBody.Krb5Principal]; ok {
 					w.WriteHeader(tr.status)
 					_, err := w.Write(tr.body)
 					require.NoError(t, err)
+					require.Equal(t, sshProtocol, requestBody.Protocol)
 				} else if tr, ok := keyResponses[requestBody.KeyId]; ok {
 					w.WriteHeader(tr.status)
 					_, err := w.Write(tr.body)
 					require.NoError(t, err)
+					require.Equal(t, sshProtocol, requestBody.Protocol)
 				}
 			},
 		},