import type { FastifyRequest } from 'fastify';

// Mirrors the boocode pattern: there is no app-layer auth — Authelia handles
// it at the reverse proxy (CLAUDE.md). All broker.publishUser calls use
// 'default' as the user key. We accept Remote-User when present (set by the
// proxy in prod) and fall back to 'default' on direct Tailscale access.
export function getUser(req: FastifyRequest): string {
  const header = req.headers['remote-user'];
  if (typeof header === 'string' && header.length > 0) return header;
  return 'default';
}