using System.Threading;
using System.Threading.Tasks;

namespace GB5Shared.Auth.Jwt
{
    /// <summary>
    /// Shared HMAC-SHA256 access-token issuance mechanics — the part every hand-rolled per-module
    /// JWT service (DXPJwtService, ClientJwtService, ...) used to duplicate byte-for-byte. Each
    /// consumer keeps its own claims type, its own options (issuer/audience/lifetimes), and its
    /// own Vault path; only the actual JwtSecurityToken construction and signing is shared here.
    /// </summary>
    public interface IJwtAccessTokenIssuer
    {
        /// <summary>
        /// Signs and returns an access token for <paramref name="claims"/>. The signing key is
        /// resolved via <see cref="IJwtSigningKeyResolver"/> at <paramref name="signingKeyVaultPath"/>.
        /// </summary>
        Task<JwtIssuedAccessToken> IssueAsync(
            IJwtClaimsSource claims,
            string signingKeyVaultPath,
            string issuer,
            string audience,
            int accessTokenMinutes,
            CancellationToken ct);
    }
}