namespace NATS.Server.Auth;

public interface IExternalAuthClient
{
    /// <summary>
    /// Requests an allow/deny decision from an external authentication provider.
    /// </summary>
    /// <param name="request">Credential material and identity hints from the client connection.</param>
    /// <param name="ct">Cancellation token bound to auth timeout and connection lifecycle.</param>
    Task<ExternalAuthDecision> AuthorizeAsync(ExternalAuthRequest request, CancellationToken ct);
}

public sealed record ExternalAuthRequest(
    string? Username,
    string? Password,
    string? Token,
    string? Jwt);

public record ExternalAuthDecision(
    bool Allowed,
    string? Identity = null,
    string? Account = null,
    string? Reason = null);

public sealed class ExternalAuthOptions
{
    /// <summary>
    /// Gets or sets a value indicating whether external auth callouts are enabled.
    /// </summary>
    public bool Enabled { get; set; }

    /// <summary>
    /// Gets or sets the timeout budget for each external auth decision request.
    /// </summary>
    public TimeSpan Timeout { get; set; } = TimeSpan.FromSeconds(2);

    /// <summary>
    /// Gets or sets the client implementation responsible for external auth decisions.
    /// </summary>
    public IExternalAuthClient? Client { get; set; }
}

public sealed class ProxyAuthOptions
{
    /// <summary>
    /// Gets or sets a value indicating whether trusted-proxy authentication mode is enabled.
    /// </summary>
    public bool Enabled { get; set; }

    /// <summary>
    /// Gets or sets the required username prefix marking identities provided by a trusted proxy.
    /// </summary>
    public string UsernamePrefix { get; set; } = "proxy:";

    /// <summary>
    /// Gets or sets the default account to assign when proxy-authenticated users omit one.
    /// </summary>
    public string? Account { get; set; }
}