// Package auth holds authentication wiring for admin-api: Pocket-ID
// Authorization-Code / session-cookie middleware and the context accessors
// used by downstream handlers to read the authenticated principal.
package auth

import "context"

type principalKey struct{}
type sessionKey struct{}

// WithPrincipal attaches the authenticated admin user (`sub` claim) to ctx.
func WithPrincipal(ctx context.Context, sub string) context.Context {
	return context.WithValue(ctx, principalKey{}, sub)
}

// WithSession attaches the Pocket-ID session identifier (`sid` claim or
// server-side session id) to ctx. Downstream code carries it into
// attestations so audits show which session triggered the change.
func WithSession(ctx context.Context, sessionID string) context.Context {
	return context.WithValue(ctx, sessionKey{}, sessionID)
}

// PrincipalFrom returns the `sub` previously set by WithPrincipal, or
// "unknown" if the context never passed through the auth middleware.
func PrincipalFrom(ctx context.Context) string {
	if v, ok := ctx.Value(principalKey{}).(string); ok {
		return v
	}
	return "unknown"
}

// SessionFrom returns the session id previously set by WithSession, or "".
func SessionFrom(ctx context.Context) string {
	if v, ok := ctx.Value(sessionKey{}).(string); ok {
		return v
	}
	return ""
}