#ifndef THIRD_PARTY_MILOTIC_EXTERNAL_CC_AUTHZ_PEER_IDENTITY_GRPC_H_
#define THIRD_PARTY_MILOTIC_EXTERNAL_CC_AUTHZ_PEER_IDENTITY_GRPC_H_

#include "peer_identity.h"
#include "g3/grpc_headers.h"

namespace milotic::authz {

// Extracts the peer's SPIFFE identity (and FQDN, when present) from a gRPC
// auth context's X.509 SAN properties. Returns UNAUTHENTICATED if the peer is
// not authenticated and PERMISSION_DENIED if its identity is not an X.509 SAN.
//
// Kept separate from peer_identity.h so that the identity type itself carries
// no gRPC dependency. Named "Extract..." (not "Get...FromAuthContext") to stay
// distinct from BmcWebAuthorizerSingleton's same-purpose static, which
// delegates here.
grpc::Status ExtractPeerIdentityFromAuthContext(
    const grpc::AuthContext& context, PeerSpiffeIdentity& peer_identity);

}  // namespace milotic::authz

#endif  // THIRD_PARTY_MILOTIC_EXTERNAL_CC_AUTHZ_PEER_IDENTITY_GRPC_H_