import { Observable } from 'rxjs';

/**
 * Prep interfaces for a future Ed25519 challenge/response admin auth flow.
 * No crypto is implemented here - verification is delegated to an injectable
 * service so the real implementation (native WebCrypto Ed25519 support, or a
 * backend verification call) can be swapped in once the backend API exists,
 * without touching AdminAuthService or components.
 */
export interface Ed25519Challenge {
  nonce: string;
  timestamp: string;
  /** Opaque challenge payload the client must sign with its private key. */
  payload: string;
}

export interface Ed25519SignedResponse {
  challenge: Ed25519Challenge;
  publicKey: string;
  signature: string;
}

export interface Ed25519VerificationResult {
  valid: boolean;
  reason?: string;
}

export abstract class Ed25519VerificationService {
  abstract requestChallenge(): Observable<Ed25519Challenge>;
  abstract verify(response: Ed25519SignedResponse): Observable<Ed25519VerificationResult>;
}
