namespace DodoSSH.Api.Features.Identity;

/// <summary>
/// Source-generated log events for identity and enrollment.
/// </summary>
/// <remarks>
/// Ids, counts and outcomes only. Never a wrap, a token, a nonce or a public key: an enrollment log
/// line that carried key material would put in the log exactly what the vault design exists to keep
/// out of the server's reach.
/// </remarks>
internal static partial class IdentityLog
{
    [LoggerMessage(
        EventId = 2001,
        Level = LogLevel.Information,
        Message = "Enrolled identity key generation {Generation} for user {UserId} at key log sequence {Sequence}.")]
    internal static partial void Enrolled(ILogger logger, Guid userId, int generation, long sequence);

    [LoggerMessage(
        EventId = 2002,
        Level = LogLevel.Information,
        Message = "Enrollment retry for user {UserId} matched the stored key; returning the original result.")]
    internal static partial void EnrollmentReplayed(ILogger logger, Guid userId);

    [LoggerMessage(
        EventId = 2003,
        Level = LogLevel.Warning,
        Message = "Rejected enrollment for user {UserId}: the identity provider binding did not verify.")]
    internal static partial void BindingRejected(ILogger logger, Guid userId);

    [LoggerMessage(
        EventId = 2004,
        Level = LogLevel.Warning,
        Message = "Rejected enrollment for user {UserId}: the key statement self-signature did not verify.")]
    internal static partial void StatementSignatureRejected(ILogger logger, Guid userId);
}