namespace ERPCore.Infra.Auth;

/// <summary>
/// Abstraction over the authenticated principal, used purely as the audit actor
/// (RBAC is deferred for Phase 1). The actor is derived from the token's `sub`
/// claim — never from the request body (see 00-CORE §4).
/// </summary>
public interface ICurrentUser
{
    /// <summary>The audit actor identity (token `sub`), or "system" when unauthenticated.</summary>
    string UserId { get; }

    /// <summary>
    /// Numeric audit actor for stamping document <c>createdBy</c>/<c>requestedBy</c> FKs.
    /// Resolves the token <c>sub</c> to a user id; falls back to the seeded system
    /// user (<see cref="Entities.User.SystemUserId"/>) while auth is deferred (§6).
    /// </summary>
    int AuditUserId { get; }

    /// <summary>True when the request carries an authenticated principal.</summary>
    bool IsAuthenticated { get; }
}
