package automation

import (
	"context"
	"strings"
)

// afterCommitScheduledFlowExecutionKey is intentionally private: only the
// immutable scheduled-plan binder may mint this marker after it has proved the
// strict AsyncAfterCommit entry and exact root FlowVersion.
type afterCommitScheduledFlowExecutionKey struct{}

// WithAfterCommitScheduledFlowExecution binds one immutable root FlowVersion
// to a strict AsyncAfterCommit worker execution. It authorizes no other flow
// version and is separate from the connector-inbound marker so scheduled work
// cannot impersonate inbound request handling.
func WithAfterCommitScheduledFlowExecution(ctx context.Context, versionID string) context.Context {
	if ctx == nil {
		ctx = context.Background()
	}
	versionID = strings.TrimSpace(versionID)
	if versionID == "" {
		return ctx
	}
	return context.WithValue(ctx, afterCommitScheduledFlowExecutionKey{}, versionID)
}

// AfterCommitScheduledFlowExecutionAuthorizesVersion reports whether ctx is
// bound to this exact immutable FlowVersion for strict AsyncAfterCommit work.
func AfterCommitScheduledFlowExecutionAuthorizesVersion(ctx context.Context, versionID string) bool {
	if ctx == nil || strings.TrimSpace(versionID) == "" {
		return false
	}
	bound, _ := ctx.Value(afterCommitScheduledFlowExecutionKey{}).(string)
	return bound == strings.TrimSpace(versionID)
}