package bouncer

import "context"

type userKey struct{}

// Principal is the authenticated identity stored on the request context.
type Principal struct {
	ID                 uint
	MustChangePassword bool
}

// WithUser stores the verified principal on ctx.
func WithUser(ctx context.Context, user *Principal) context.Context {
	if ctx == nil {
		ctx = context.Background()
	}
	return context.WithValue(ctx, userKey{}, user)
}

// User returns the verified principal from ctx.
func User(ctx context.Context) (*Principal, bool) {
	if ctx == nil {
		return nil, false
	}
	u, ok := ctx.Value(userKey{}).(*Principal)
	return u, ok && u != nil
}

type credentialKey struct{}

// WithCredential stores the resolved credential (e.g. *ApiToken) on ctx.
func WithCredential(ctx context.Context, cred any) context.Context {
	if ctx == nil {
		ctx = context.Background()
	}
	return context.WithValue(ctx, credentialKey{}, cred)
}

// Credential returns the resolved credential from ctx.
func Credential(ctx context.Context) (any, bool) {
	if ctx == nil {
		return nil, false
	}
	c := ctx.Value(credentialKey{})
	if c == nil {
		return nil, false
	}
	return c, true
}