using Dpz.Core.Auth.Models.AdminApi;
using Dpz.Core.Public.ViewModel.WebAuthn;

namespace Dpz.Core.Auth.Service;

public interface IUserMfaVerificationService
{
    /// <summary>
    /// 验证后台敏感操作的 2FA 动态验证码，强制要求用户已绑定 2FA
    /// </summary>
    Task<ResponseResult> ValidateRequiredTwoFactorAsync(
        string? account,
        string? pinCode,
        CancellationToken cancellationToken = default
    );

    /// <summary>
    /// 验证登录和修改密码的 2FA 动态验证码，未绑定 2FA 时跳过验证
    /// </summary>
    Task<ResponseResult> ValidateOptionalTwoFactorAsync(
        string? account,
        string? pinCode,
        CancellationToken cancellationToken = default
    );

    /// <summary>
    /// 验证后台敏感操作，优先使用当前设备的 Passkey，当前设备不可用时回退至 2FA 动态验证码；
    /// 账号未绑定任何 MFA 方式时操作直接放行（NeedsSecuritySetup=true），由前端提醒用户完成安全绑定
    /// </summary>
    Task<ResponseResult<AdminMfaVerificationResult>> VerifyAdminOperationAsync(
        string? account,
        string operationKey,
        AdminMfaRequest? request,
        CancellationToken cancellationToken = default
    );

    /// <summary>
    /// 为 Passkey 敏感操作创建 WebAuthn 断言参数
    /// </summary>
    Task<PasskeyOperationVerificationOptions?> BeginPasskeyOperationAsync(
        string account,
        string targetCredentialId,
        string purpose,
        CancellationToken cancellationToken = default
    );

    /// <summary>
    /// 验证 Passkey 敏感操作的 WebAuthn 断言
    /// </summary>
    Task<ResponseResult> CompletePasskeyOperationAsync(
        string account,
        string targetCredentialId,
        string purpose,
        DeleteWebAuthnCredentialRequest request,
        CancellationToken cancellationToken = default
    );
}

public class PasskeyOperationVerificationOptions
{
    public required AssertionOptions AssertionOptions { get; set; }

    public required string Challenge { get; set; }
}