import Foundation

/// Pluggable auth for outgoing Feature Control requests. No `Atomenta-Token` type
/// exists here on purpose — that module token must never be embedded in a
/// customer-facing app (see FC-060 §1 in Atomenta's `docs/feature-control/`).
/// A consumer who insists on it does so explicitly via `FeatureControlHeaderAuth`.
public protocol FeatureControlAuthorizing: Sendable {
    func authorize(_ headers: inout [String: String]) async
}

/// For internal/admin apps hitting Atomenta directly with a panel-role JWT.
public struct FeatureControlBearerAuth: FeatureControlAuthorizing {
    private let tokenProvider: @Sendable () async -> String?

    public init(tokenProvider: @escaping @Sendable () async -> String?) {
        self.tokenProvider = tokenProvider
    }

    public func authorize(_ headers: inout [String: String]) async {
        guard let token = await tokenProvider() else { return }
        headers["Authorization"] = "Bearer \(token)"
    }
}

/// For a customer app calling its own BFF, which enforces its own auth. Adds
/// exactly the given headers — never synthesizes an `Authorization` header.
public struct FeatureControlHeaderAuth: FeatureControlAuthorizing {
    private let headers: [String: String]

    public init(headers: [String: String]) {
        self.headers = headers
    }

    public func authorize(_ headers: inout [String: String]) async {
        for (key, value) in self.headers {
            headers[key] = value
        }
    }
}