"""API-key authentication and tenant resolution (ADR-0008).

`resolve_auth_context` is the entry point: it takes a bearer token and
returns a trusted `AuthContext`. Everything downstream of the FastAPI
boundary receives `tenant_id` only through that context — never from a
request body, query string, or object metadata.
"""

from src.application.auth.context import AuthContext
from src.application.auth.errors import (
    AuthError,
    InvalidApiKeyError,
    MissingScopeError,
    TenantInactiveError,
)
from src.application.auth.keys import generate_api_key, hash_secret, verify_secret
from src.application.auth.service import resolve_auth_context

__all__ = [
    "AuthContext",
    "AuthError",
    "InvalidApiKeyError",
    "MissingScopeError",
    "TenantInactiveError",
    "generate_api_key",
    "hash_secret",
    "resolve_auth_context",
    "verify_secret",
]