/* SPDX-License-Identifier: GPL-3.0-only */
/* Private, allocation-free parsing only: these helpers do not authorize requests. */
#pragma once

#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>

#define WEB_AUTH_ORIGIN_CAPACITY 129U
#define WEB_AUTH_COOKIE_HEADER_MAX 1024U
#define WEB_AUTH_TOKEN_LENGTH 64U
#define WEB_AUTH_LOGIN_BODY_MAX 512U
#define WEB_AUTH_USERNAME_MAX 16U
#define WEB_AUTH_PASSWORD_MAX 64U

typedef struct {
    size_t username_length;
    size_t password_length;
    uint8_t username[WEB_AUTH_USERNAME_MAX + 1U];
    uint8_t password[WEB_AUTH_PASSWORD_MAX + 1U];
} web_auth_credentials_t;

/* Exact byte spans, not necessarily NUL-terminated. Inputs and output must not
 * alias. Failures clear output. Host supports ASCII DNS/IPv4 authorities only;
 * IPv6 literals are deliberately rejected until the device supports that route.
 * Only optional :443 is accepted. Origin is mandatory and must match Host.
 * HTTP callers must separately reject duplicate header lines, enforce methods,
 * body/content-type limits, Fetch Metadata and CSRF/session policy. */
bool web_auth_parse_origin(const char *host, size_t host_length,
                           const char *origin, size_t origin_length,
                           char canonical[WEB_AUTH_ORIGIN_CAPACITY]);
/* Extract exactly one named lowercase-hex token; malformed/duplicate or missing
 * selected cookie fails. Other cookies are syntax-checked but not retained.
 * This deliberately accepts only unquoted cookie values, including unrelated
 * cookies; quoted values fail closed. No whitespace inside a cookie pair.
 * name is a trusted, nonempty C string. Output is sensitive: wipe after use. */
bool web_auth_parse_cookie(const char *header, size_t length, const char *name,
                           char token[WEB_AUTH_TOKEN_LENGTH + 1U]);
/* As above, but a missing selected cookie is valid with present=false. This
 * lets HTTP policy distinguish absence from malformed/ambiguous cookies. */
bool web_auth_parse_optional_cookie(const char *header, size_t length, const char *name,
                                    char token[WEB_AUTH_TOKEN_LENGTH + 1U], bool *present);
/* Decode one string at *position (including optional JSON whitespace). Capacity
 * includes the terminator. Failure wipes output and leaves position unchanged.
 * Success output is sensitive; caller must wipe it. Same strict decoder as login. */
bool web_auth_parse_json_string(const char *body, size_t length, size_t *position,
                                 uint8_t *output, size_t capacity, size_t *decoded_length);
/* Exactly username/password string fields, either order. JSON escapes and valid
 * UTF-8 accepted; unknown/duplicate fields, NUL and malformed Unicode rejected.
 * Database credential policy remains authoritative. Caller must wipe BOTH the
 * original request body and successful credentials using secure_wipe(). */
bool web_auth_parse_login(const char *body, size_t length,
                          web_auth_credentials_t *credentials);