package authmw

import (
	"net/http"

	"code.nochebuena.dev/einherjar/contracts/security"
)

// BagEnricher enriches the request-scoped SecurityBag.
//
// Called sequentially by [EnrichmentMiddleware] after the base Identity is
// built from uid+claims. Each enricher receives the current bag and must
// return a new bag — the receiver is never modified.
//
// Typical uses: setting TenantID from a request header, attaching a hardware
// ID to the bag, injecting a grant code from an out-of-band lookup.
//
// Register enrichers via [WithBagEnricher]. [WithTenantHeader] is a
// convenience constructor for the most common single-header case.
type BagEnricher func(bag security.SecurityBag, r *http.Request) security.SecurityBag