package usecase

import (
	"context"
	"errors"
	"time"

	"cmroubao/backend-api/internal/domain"
)

type PasswordManager interface {
	Hash(string) (string, error)
	Verify(string, string) error
	VerifyDummy(string)
}

type OpaqueTokenGenerator interface {
	NewToken() (string, error)
}

type AuthRepository interface {
	FindUserByUsername(context.Context, string) (domain.User, error)
	ProvisionUser(context.Context, domain.User) (domain.User, error)
	ProvisionDevice(context.Context, domain.Device) (domain.Device, error)
	ResetUserPassword(context.Context, string, string, time.Time) error
	SetUserActive(context.Context, string, bool, time.Time) error
	SetDeviceEnabled(context.Context, string, bool, time.Time) error
	CreateAdminSession(
		context.Context,
		domain.AdminSession,
		time.Time,
	) error
	AuthenticateAdminSession(
		context.Context,
		string,
		time.Time,
	) (domain.AuthPrincipal, error)
	RevokeAdminSession(context.Context, string, time.Time) error
	CreateAccessTokenAndBindDevice(
		context.Context,
		string,
		string,
		string,
		string,
		string,
		domain.AccessToken,
		time.Time,
	) (domain.Device, error)
	AuthenticateAccessToken(
		context.Context,
		string,
		time.Time,
	) (domain.AuthPrincipal, error)
}

var (
	ErrAuthCredentials = errors.New("authentication credentials are invalid")
	ErrAuthDisabled    = errors.New("authentication subject is disabled")
	ErrAuthForbidden   = errors.New("authentication role is forbidden")
	ErrAuthExpired     = errors.New("authentication session expired")
	ErrAuthRevoked     = errors.New("authentication session revoked")
	ErrAuthConflict    = errors.New("authentication resource conflict")
)