use std::sync::Arc;

use async_trait::async_trait;
use crank_core::{MachineAccessMode, OperationSecurityLevel, PlatformApiKeyScope};

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct VerifiedMachineCredential {
    pub machine_access_mode: MachineAccessMode,
    pub max_security_level: OperationSecurityLevel,
    pub scopes: Vec<PlatformApiKeyScope>,
}

#[async_trait]
pub trait MachineCredentialVerifier: Send + Sync {
    async fn verify_bearer_token(
        &self,
        workspace_slug: &str,
        agent_slug: &str,
        token: &str,
    ) -> Result<Option<VerifiedMachineCredential>, MachineCredentialVerifierError>;
}

pub type SharedMachineCredentialVerifier = Arc<dyn MachineCredentialVerifier>;

#[derive(Clone, Default)]
pub struct CommunityMachineCredentialVerifier;

#[derive(Debug, thiserror::Error)]
#[error("machine credential verifier failed")]
pub struct MachineCredentialVerifierError;

#[async_trait]
impl MachineCredentialVerifier for CommunityMachineCredentialVerifier {
    async fn verify_bearer_token(
        &self,
        _workspace_slug: &str,
        _agent_slug: &str,
        _token: &str,
    ) -> Result<Option<VerifiedMachineCredential>, MachineCredentialVerifierError> {
        Ok(None)
    }
}
