namespace ErsatzTV.Application.Auth;

public enum LocalPasswordVerification
{
    Failed,
    Success,
    SuccessRehashNeeded
}

/// <summary>
///     Wraps ASP.NET Core Identity's <c>PasswordHasher</c> (PBKDF2) behind a minimal, framework-agnostic
///     surface so the Auth handlers don't depend on Identity types directly.
/// </summary>
public interface ILocalPasswordHasher
{
    /// <summary>Hashes a password for storage (random per-hash salt embedded in the returned string).</summary>
    string Hash(string password);

    /// <summary>Verifies a password against a stored hash in constant time (delegated to Identity).</summary>
    LocalPasswordVerification Verify(string hash, string password);

    /// <summary>
    ///     A stable, valid hash of a throwaway password. Verify against this when no real credential exists
    ///     so an unknown-username / unconfigured login costs the same as a real one (no user enumeration).
    /// </summary>
    string DummyHash { get; }
}
