/* SPDX-License-Identifier: GPL-3.0-only */
#pragma once
#include <stdint.h>
#include "esp_http_server.h"

/* One session-bound pending/result slot. Dispatcher execution only; completed
 * results are replaceable, not durable history or an idempotent retry API. */
esp_err_t web_account_settings_handler(httpd_req_t *request);
void web_account_settings_execute(uint32_t id);
/* POST /api/settings/accounts/keys: admin cookie + Origin/CSRF, JSON exactly
 * {username,user_id,auth_generation}. Read-only zero-wait snapshot, 512-byte
 * response bound: {username,user_id,auth_generation,keys:[{index,type,fingerprint}]}.
 * Fingerprints are OpenSSH SHA256: base64 without padding, never key blobs.
 * Stale/absent target: 409 {error:"stale"}; busy DB: 503 accounts_unavailable.
 * Register independently as an optional POST route.
 *
 * Existing account-operation POST adds key-add (+public_key, OpenSSH text <=384
 * decoded bytes), key-delete (+key_index integer 0..2), key-clear. All require
 * username/user_id/auth_generation. Exact schemas, <=768 body bytes/4 receives.
 * Text/base64 errors: 400; canonical SSH blob/curve validation runs on dispatcher
 * (failed result). Duplicate/full/stale use existing named result states.
 * Success target-revokes immediately, including self; lost response/401 remains
 * uncertain, never proof of cancellation. No automatic mutation retries. */
esp_err_t web_account_keys_handler(httpd_req_t *request);
/* POST /api/settings/accounts/generate-password; bodyless admin cookie +
 * Origin/CSRF. RNG only, no queued/account/persistent state or retrieval. */
esp_err_t web_account_generate_password_handler(httpd_req_t *request);