"""The trusted request-scoped auth/tenant context (ADR-0008)."""

import uuid
from dataclasses import dataclass


@dataclass(frozen=True)
class AuthContext:
    tenant_id: uuid.UUID
    tenant_slug: str
    api_key_id: uuid.UUID
    scopes: frozenset[str]
    actor_type: str

    def has_scope(self, scope: str) -> bool:
        return scope in self.scopes or "admin" in self.scopes