package auth

import "context"

// Presentation is HOW the session was presented. It exists for the CSRF layer and for logs, never
// for authorization: a session is a session whichever way it arrived.
type Presentation string

const (
	ViaCookie Presentation = "cookie"
	ViaBearer Presentation = "bearer"
)

// Principal is the authenticated caller.
type Principal struct {
	UserID string
	Via    Presentation
}

type principalKey struct{}

// withPrincipal is deliberately unexported: the principal is created in the middleware of this
// package and nowhere else (D39.84). A handler that could mint one could also invent a user.
func withPrincipal(ctx context.Context, p Principal) context.Context {
	return context.WithValue(ctx, principalKey{}, p)
}

// FromContext returns the principal established by Authenticator.
func FromContext(ctx context.Context) (Principal, bool) {
	p, ok := ctx.Value(principalKey{}).(Principal)
	return p, ok
}