/*
 * server/identity.h — Server identity manager.
 *
 * Loads or generates the Ed25519 identity key + self-signed TLS cert on first run.
 * Persists both to data_dir/identity.key and data_dir/server.{crt,key}.
 */
#ifndef VOICECAT_SERVER_IDENTITY_H
#define VOICECAT_SERVER_IDENTITY_H

#ifdef VOICECAT_HAS_NET

#include <filesystem>
#include <string>

#include "crypto/crypto.h"

namespace voicecat::server {

class ServerIdentityManager {
   public:
    // Load from data_dir, or generate on first run.
    // Returns false on fatal I/O error.
    bool init(const std::filesystem::path& data_dir, const std::string& server_name,
              std::string& error);

    const crypto::ServerIdentity& identity() const { return identity_; }
    const crypto::ServerCert&     cert()     const { return cert_; }

    // "AA:BB:CC:..." hex for display
    std::string fingerprint_display() const { return identity_.fingerprint_hex(); }

   private:
    crypto::ServerIdentity identity_;
    crypto::ServerCert     cert_;
};

}  // namespace voicecat::server

#endif  // VOICECAT_HAS_NET
#endif  // VOICECAT_SERVER_IDENTITY_H