// Package attest hands off a rate-change event to the Signing Service and
// returns the SHA-256 of the signed attestation envelope. Current state:
// Stub — PERSUB will be wired in Phase-2.
package attest

import (
	"context"
	"errors"

	"basicstack.de/proofedmesh/services/admin-api/internal/model"
)

type ChangeKind string

const (
	ChangeCreate ChangeKind = "create"
	ChangeRetire ChangeKind = "retire"
)

// RateChangeEvent is what we hand to the Signing Service.
type RateChangeEvent struct {
	Kind          ChangeKind
	Rate          model.Rate
	PerformedBy   PerformedBy
	PerformedAtRFC3339 string
}

type PerformedBy struct {
	Issuer    string
	Subject   string
	SessionID string
}

// Signer issues a signed rate_change attestation and returns the content hash
// (sha256:...) under which it is stored in the Transparency Log.
type Signer interface {
	SignRateChange(ctx context.Context, ev RateChangeEvent) (attestationRef string, err error)
}

// NopSigner is a placeholder that lets the admin-api start without a real
// Signing Service. It must not be used in production — the HTTP layer gates
// its usage behind a startup flag.
type NopSigner struct{}

var errNopNotForProd = errors.New("attest.NopSigner is a stub and must not be used in production")

func (NopSigner) SignRateChange(ctx context.Context, ev RateChangeEvent) (string, error) {
	return "", errNopNotForProd
}