package app

import (
	"context"

	"lingniu/vehicle-data-platform/apps/api/internal/platform"
)

// IdentityAdapter is the narrow trust boundary for a future Yudao Cloud,
// RuoYi Sys or company SSO integration. Implementations must validate a signed,
// short-lived credential (or use server-side introspection) before returning a
// principal. Unsigned forwarding headers must never implement this interface.
//
// External identities should be mapped to platform_user through
// (auth_provider, external_subject); menu and vehicle grants remain platform
// authorization data so changing an upstream login system cannot bypass Scope.
type IdentityAdapter interface {
	Name() string
	AuthenticateBearer(context.Context, string) (platform.Principal, bool, error)
}