package ssh

import "strings"

// Identity is the authenticated principal for an SSH connection, resolved
// either from a certificate (local or federated) or from a raw registered
// key (local only), per DESIGN.md §5.1.
type Identity struct {
	Principal string // "<username>@<domain>"
	Username  string
	Domain    string
	Local     bool
	PubKey    string // authorized_keys format, set only for raw-key auth
}

func splitPrincipal(principal string) (username, domain string, ok bool) {
	i := strings.LastIndex(principal, "@")
	if i <= 0 || i == len(principal)-1 {
		return "", "", false
	}
	return principal[:i], principal[i+1:], true
}

const (
	extPrincipal = "gitfed-principal"
	extUsername  = "gitfed-username"
	extDomain    = "gitfed-domain"
	extLocal     = "gitfed-local"
	extPubKey    = "gitfed-pubkey" // authorized_keys format, only set for raw-key auth
)