Initial curated itworx-knowledge-hub source from 3b1751d0d9dee551aa6994eee0093704dc334817

src/backend/ItWorx.KnowledgeHub.Application/Automation/IServiceAccountTokenIssuer.cs

@@ -0,0 +1,20 @@
+namespace ItWorx.KnowledgeHub.Application.Automation;
+
+public sealed record IssuedToken(string PublicId, string SecretHash, string RawToken);
+
+/// <summary>
+/// Generates and verifies <c>ikh_&lt;public-id&gt;_&lt;secret&gt;</c> bearer tokens
+/// (docs/09-api-contract.md "Service account"). The raw secret is never persisted —
+/// only its hash.
+/// </summary>
+public interface IServiceAccountTokenIssuer
+{
+    IssuedToken IssueNewToken();
+
+    /// <summary>Parses a presented <c>Authorization: Bearer</c> value into its public
+    /// ID and secret, or returns false if it is not well-formed — never throws on
+    /// attacker-controlled input.</summary>
+    bool TryParse(string presentedToken, out string publicId, out string secret);
+
+    string HashSecret(string secret);
+}