// CF Workers no-op shim for @blocklet/sdk/lib/util/verify-session.
//
// In CF Workers, Bearer / cookie validation happens *before* Express routes
// run — see worker.ts auth middleware at /api/*, which calls
// `c.env.AUTH_SERVICE.resolveIdentity(...)` and injects x-user-did into the
// request headers when the token is valid. By the time security.ts'
// `authenticate` middleware sees the request, the x-user-did branch handles
// it. The fallback Bearer-validation path that calls verifyLoginToken
// directly is only needed in the Express dev server, where the tunnel
// bypasses Blocklet Server's nginx and we can't rely on header injection.
//
// So in Workers we return null — security.ts treats null as "couldn't
// validate locally, fall through" — and the x-user-did set by the worker
// layer is the source of truth.

export type SessionUser = {
  did: string;
  role?: string;
  fullName?: string;
  provider?: string;
  walletOS?: string;
  method?: string;
  org?: string;
};

export async function verifyLoginToken(_opts: { token: string; strictMode?: boolean }): Promise<SessionUser | null> {
  return null;
}

export async function verifyAccessKey(_opts: { token: string; strictMode?: boolean }): Promise<SessionUser | null> {
  return null;
}

export async function verifyComponentCall(_opts: { req: any; strictMode?: boolean }): Promise<SessionUser | null> {
  return null;
}

export async function verifySignedToken(_opts: { token: string; strictMode?: boolean }): Promise<SessionUser | null> {
  return null;
}

export function getSessionSecret(): string {
  return '';
}
