#ifndef ORBITHUB_VNC_APPLE_DH_AUTH_H
#define ORBITHUB_VNC_APPLE_DH_AUTH_H

#include <QByteArray>
#include <QString>

// Apple's Screen Sharing authentication scheme (RFB security type 30):
// Diffie-Hellman key exchange followed by AES-128-ECB-encrypted
// credentials. Apple never published this officially -- it's not part of
// RFC 6143 -- so this implements the well-established reverse-engineered
// wire format used by several independent VNC clients, not a primary
// spec. Kept as a pure, state-free helper (no socket access) so it's
// unit-testable without a live connection, mirroring
// VncSessionBackend::vncAuthResponse()'s shape for standard VNC
// Authentication.
namespace VncAppleDhAuth {

struct Response {
    // Same byte length as the server's prime, big-endian, zero-padded.
    // Empty on any failure (malformed input, an OpenSSL operation
    // failing) -- callers should treat an empty clientPublicKey as "could
    // not compute a response" rather than send a degenerate one.
    QByteArray clientPublicKey;
    // Always exactly 128 bytes on success (16 AES blocks): a 64-byte
    // NUL-padded/truncated username followed by a 64-byte NUL-padded/
    // truncated password, AES-128-ECB encrypted (no padding, since the
    // plaintext is already an exact multiple of the block size) with a
    // key derived as MD5(sharedSecret).
    QByteArray encryptedCredentials;
};

// Computes the DH keypair, the shared secret, the derived AES key, and
// the encrypted credential blob, using modern EVP-based OpenSSL 3.0 APIs
// throughout (no deprecated low-level DH_*/legacy calls -- unlike VNC
// Authentication's classic DES usage, none of MD5/AES-ECB/the EVP_PKEY DH
// APIs are deprecated, so no compatibility pragma is needed here).
// Returns a Response with an empty clientPublicKey on any failure.
Response computeResponse(const QByteArray& generator, const QByteArray& prime,
                         const QByteArray& serverPublicKey, const QString& username,
                         const QString& password);

}

#endif