package wang.yaojia.webterm.tlsandroid

/**
 * B4 · A seam over the three non-exportable hardware-key operations [DeviceEnroller]'s
 * enroll/renew orchestration needs. Production wires the real AndroidKeyStore-backed
 * [HardwareKeyStore] (StrongBox → TEE); a JVM unit test wires a software P-256 double, so the
 * enroll/commit orchestration (request shaping, error handling, the two-store commit sequencing)
 * can be exercised without an emulator. NOTHING about the hardware-key policy leaks through this
 * seam beyond generate/load/delete — the key stays non-exportable in the real implementation.
 */
public interface DeviceKeyProvider {
    /** Generate a fresh non-exportable key at [alias], overwriting any prior entry there. */
    public fun generate(alias: String): HardwareBackedKey

    /** Load a previously-generated key by [alias], or null if no entry exists (pre-enroll state). */
    public fun load(alias: String): HardwareBackedKey?

    /** Delete the key entry at [alias]. Idempotent (a missing alias is a no-op). */
    public fun delete(alias: String)
}

/**
 * The production [DeviceKeyProvider] — a thin delegate to the AndroidKeyStore-backed
 * [HardwareKeyStore]. Kept as a stateless object so it can be the [DeviceEnroller] constructor
 * default without any wiring.
 */
public object HardwareDeviceKeyProvider : DeviceKeyProvider {
    override fun generate(alias: String): HardwareBackedKey = HardwareKeyStore.generate(alias)

    override fun load(alias: String): HardwareBackedKey? = HardwareKeyStore.load(alias)

    override fun delete(alias: String): Unit = HardwareKeyStore.delete(alias)
}
