// Package auth exposes the two identity sources dummy-sink uses to call
// the signing-service:
//
//  1. Pocket-ID client_credentials access token (Authorization: Bearer …)
//  2. Projected ServiceAccount token (X-Workload-Token …) read from a
//     kubelet-managed Volume (`projected: { serviceAccountToken: … }`).
//
// Both are modelled behind the same TokenSource interface so the
// orchestration code never cares about the identity's origin. The split
// mirrors services/testagent-transform/internal/auth and services/
// approval-service/internal/signer; both of those services already use
// the double-identity flow against signing-service.
package auth

import "context"

// TokenSource returns a bearer-style token. Implementations may cache
// internally; the caller is expected to retry on error.
type TokenSource interface {
	Token(ctx context.Context) (string, error)
}

// StaticToken is a constant TokenSource. Primarily used in tests.
type StaticToken string

// Token returns s.
func (s StaticToken) Token(_ context.Context) (string, error) { return string(s), nil }

// TokenFunc adapts a plain function to TokenSource.
type TokenFunc func(ctx context.Context) (string, error)

// Token calls f.
func (f TokenFunc) Token(ctx context.Context) (string, error) { return f(ctx) }