package httpapi

import "net/http"

// requireSessionIdentity resolves the authenticated actor for business write
// handlers. Since sessions arrived, request bodies no longer carry
// operator_ref / reviewer_ref / created_by; the server stamps the session.
// Returns false after writing the error response.
func requireSessionIdentity(w http.ResponseWriter, r *http.Request) (sessionIdentity, bool) {
	identity, ok := sessionFrom(r.Context())
	if !ok {
		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "authentication required"})
		return sessionIdentity{}, false
	}
	return identity, true
}

// actorFor returns the audit actor for a business write: the session username
// when auth is enabled, or "system" for the auth-disabled development socket.
// It never trusts client input.
func actorFor(r *http.Request) string {
	if identity, ok := sessionFrom(r.Context()); ok {
		return identity.Username
	}
	return "system"
}