subject

type AuthMechanismConfig struct {
	Type        string            `yaml:"type" json:"type"`               // Authentication mechanism type (e.g., "jwt", "oauth2", "api_key")
	Entitlement EntitlementConfig `yaml:"entitlement" json:"entitlement"` // Entitlement configuration for this mechanism
}

type EntitlementConfig struct {
	Claim       string `yaml:"claim" json:"claim"`              // Claim name for detection and entitlement (e.g., "groups", "scopes")
	DisplayName string `yaml:"display_name" json:"displayName"` // Human-readable name for the claim
}

type Resolver interface {
	// ResolveUserType analyzes an authentication token and returns the SubjectContext
	ResolveUserType(authToken string) (*auth.SubjectContext, error)
}

type UserTypeConfig struct {
	Type           string                `yaml:"type" json:"type"`                      // "user" or "service_account"
	DisplayName    string                `yaml:"display_name" json:"displayName"`       // Human-readable name for user type
	Priority       int                   `yaml:"priority" json:"priority"`              // Check order (lower = higher priority)
	AuthMechanisms []AuthMechanismConfig `yaml:"auth_mechanisms" json:"authMechanisms"` // Supported authentication mechanisms
}