auth

type Agent struct {
	ID string
}

type AuthProvider interface {
	Authenticate(ctx context.Context, reqHeaders http.Header, query url.Values) (Session, error)
	// add auth to upstream requests of a session for upstream service account.
	UpstreamAuth(r *http.Request, session Session, upstreamPrincipal Principal) error
}

type Authorizer interface {
	Check(ctx context.Context, principal Principal, verb Verb, resource Resource) error
}

type Principal struct {
	User   User
	Agent  Agent
	Claims map[string]any // Raw JWT claims (nil for non-JWT auth)
}

type Resource struct {
	Name string
	Type string
}

type Session interface {
	Principal() Principal
}

type ShareContext struct {
	Token     string // the raw share token
	SessionID string // session this token grants access to
	UserID    string // owner's user ID — used for DB lookups
	ReadOnly  bool   // when true, only read operations are allowed
}

type User struct {
	ID string
}

type Verb string