// Licensed to StellaOps under the AGPL-3.0-or-later license.

namespace StellaOps.ReachGraph.Signing;

/// <summary>
/// Key store abstraction for ReachGraph signing operations.
/// Wraps the underlying cryptographic key management (Attestor, Signer module, etc.).
/// </summary>
public interface IReachGraphKeyStore
{
    /// <summary>
    /// Sign data with the specified key.
    /// </summary>
    /// <param name="keyId">The key identifier.</param>
    /// <param name="data">The data to sign (typically PAE-encoded).</param>
    /// <param name="cancellationToken">Cancellation token.</param>
    /// <returns>The signature bytes.</returns>
    Task<byte[]> SignAsync(string keyId, byte[] data, CancellationToken cancellationToken = default);

    /// <summary>
    /// Verify a signature with the specified key.
    /// </summary>
    /// <param name="keyId">The key identifier.</param>
    /// <param name="data">The data that was signed.</param>
    /// <param name="signature">The signature to verify.</param>
    /// <param name="cancellationToken">Cancellation token.</param>
    /// <returns>True if signature is valid, false otherwise.</returns>
    Task<bool> VerifyAsync(string keyId, byte[] data, byte[] signature, CancellationToken cancellationToken = default);

    /// <summary>
    /// Check if a key exists and is available for signing.
    /// </summary>
    /// <param name="keyId">The key identifier.</param>
    /// <param name="cancellationToken">Cancellation token.</param>
    /// <returns>True if key exists and can sign, false otherwise.</returns>
    Task<bool> CanSignAsync(string keyId, CancellationToken cancellationToken = default);

    /// <summary>
    /// Check if a key exists and is available for verification.
    /// </summary>
    /// <param name="keyId">The key identifier.</param>
    /// <param name="cancellationToken">Cancellation token.</param>
    /// <returns>True if key exists and can verify, false otherwise.</returns>
    Task<bool> CanVerifyAsync(string keyId, CancellationToken cancellationToken = default);
}