// Pulls the canonical gscSID off a session user. The kit's
// `session.user.id` is a NextAuth UUID; the real FreeIPA identity is
// in `gscSid`. Everything that needs to address the user across
// services (PAM grants, audit rows, anything joined to FreeIPA uid)
// must key on this — not on `user.id`.

export interface SessionWithGsc {
  gscSid?: string;
  id?: string;
}

export function getGscsid(user: SessionWithGsc | null | undefined): string | null {
  return user?.gscSid ?? null;
}
