package auth

// RequestCredentials are credentials extracted from one incoming HTTP
// request (HTTP transport only) — never sourced from local config/env/
// keychain. Converts into the same Credentials map shape strategies
// already produce, so Manager.ApplyAuthHeaders's header-building tail is
// reused unchanged for both transports; the header name/value are
// relayed verbatim to the facaded API, whatever they were on the way in
// (a prefixed "Authorization: Basic .../Bearer ..." value, or a bare
// X-Api-Key-style value).
type RequestCredentials struct {
	HeaderName string
	Value      string
}

func (c RequestCredentials) ToCredentialsMap() Credentials {
	return Credentials{
		"request_header_name":  c.HeaderName,
		"request_header_value": c.Value,
	}
}

// requestCredentialsContextKey is the HTTP-transport request-scoped
// context key: `internal/cli`'s RunHTTPHarness sets it via
// server.WithHTTPContextFunc (mcp-go's per-request, not per-session,
// context-injection hook), and `internal/tools`'s "call" handler reads it
// — the SDK re-derives this context fresh for every incoming message
// regardless of how long the underlying session's internal handling
// lives, so this works correctly across concurrent sessions.
type requestCredentialsContextKey struct{}

// RequestCredentialsContextKey is exported so internal/cli (the writer)
// and internal/tools (the reader) can share the exact same key value
// without either package depending on the other.
var RequestCredentialsContextKey = requestCredentialsContextKey{}
