namespace ItWorx.KnowledgeHub.Application.Automation;

public sealed record IssuedToken(string PublicId, string SecretHash, string RawToken);

/// <summary>
/// Generates and verifies <c>ikh_&lt;public-id&gt;_&lt;secret&gt;</c> bearer tokens
/// (docs/09-api-contract.md "Service account"). The raw secret is never persisted —
/// only its hash.
/// </summary>
public interface IServiceAccountTokenIssuer
{
    IssuedToken IssueNewToken();

    /// <summary>Parses a presented <c>Authorization: Bearer</c> value into its public
    /// ID and secret, or returns false if it is not well-formed — never throws on
    /// attacker-controlled input.</summary>
    bool TryParse(string presentedToken, out string publicId, out string secret);

    string HashSecret(string secret);
}