//! The boundary between the SSH server and forge-web (auth, authz, process building).

use std::future::Future;

use forge_git::GitService;

use crate::parse::LfsOperation;

/// Implemented by forge-web. The SSH server holds it in an `Arc`.
pub trait GitBackend: Send + Sync + 'static {
    /// Exact-match lookup of the raw public key blob, returning the user id.
    fn authenticate_key(
        &self,
        algorithm: &str,
        key_blob: &[u8],
    ) -> impl Future<Output = Option<String>> + Send;

    /// Authorizes and builds the git process (stdin and stdout are piped by the caller).
    /// `Err` sends the message on stderr and exits 1.
    fn prepare(
        &self,
        user_id: &str,
        service: GitService,
        repo_path: &str,
        git_protocol: Option<&str>,
    ) -> impl Future<Output = Result<tokio::process::Command, String>> + Send;

    /// Authorizes a `git-lfs-authenticate` request and returns the JSON reply for stdout.
    /// `repo_path` is `owner/repo` with `.git` stripped. `Err` sends the message on stderr
    /// and exits 1.
    fn lfs_authenticate(
        &self,
        user_id: &str,
        repo_path: &str,
        operation: LfsOperation,
    ) -> impl Future<Output = Result<String, String>> + Send;
}