namespace NATS.Server.Auth;

public interface IExternalAuthClient
{
    Task<ExternalAuthDecision> AuthorizeAsync(ExternalAuthRequest request, CancellationToken ct);
}

public sealed record ExternalAuthRequest(
    string? Username,
    string? Password,
    string? Token,
    string? Jwt);

public record ExternalAuthDecision(
    bool Allowed,
    string? Identity = null,
    string? Account = null,
    string? Reason = null);

public sealed class ExternalAuthOptions
{
    public bool Enabled { get; set; }
    public TimeSpan Timeout { get; set; } = TimeSpan.FromSeconds(2);
    public IExternalAuthClient? Client { get; set; }
}

public sealed class ProxyAuthOptions
{
    public bool Enabled { get; set; }
    public string UsernamePrefix { get; set; } = "proxy:";
    public string? Account { get; set; }
}
