using System.Security.Cryptography.X509Certificates;
using NATS.Server.Auth.Jwt;
using NATS.Server.Protocol;

namespace NATS.Server.Auth;

public interface IAuthenticator
{
    /// <summary>
    /// Attempts to authenticate a client connection.
    /// </summary>
    /// <param name="context">Authentication context containing credentials and transport metadata.</param>
    AuthResult? Authenticate(ClientAuthContext context);
}

public sealed class ClientAuthContext
{
    /// <summary>
    /// Gets CONNECT options and credential fields supplied by the client.
    /// </summary>
    public required ClientOptions Opts { get; init; }

    /// <summary>
    /// Gets server-issued nonce bytes used for signature-based auth flows.
    /// </summary>
    public required byte[] Nonce { get; init; }

    /// <summary>
    /// Gets the client TLS certificate presented during handshake, when available.
    /// </summary>
    public X509Certificate2? ClientCertificate { get; init; }

    /// <summary>
    /// The type of connection (e.g., "STANDARD", "WEBSOCKET", "MQTT", "LEAFNODE").
    /// Used by JWT authenticator to enforce allowed_connection_types claims.
    /// Defaults to "STANDARD" for regular NATS client connections.
    /// </summary>
    public string ConnectionType { get; init; } = JwtConnectionTypes.Standard;
}