//! Biometric manager — cross-platform state for the biometric-auth

//! surface (SUPER_PLAN_2 §1 feature 4 + research/02).

//!

//! **Request-driven**, unlike the continuous `GeolocationManager`. The

//! three callers are:

//!

//! - A **callback** invokes `App::request_biometric_auth(prompt)` (e.g.

//!   the AzulVault unlock button). The OS draws its own modal sheet; the

//!   app cannot skin it.

//!

//! - The **platform backend** (`dll/src/desktop/extra/biometric/<plat>.rs`)

//!   shows the prompt (iOS / macOS `LAContext.evaluatePolicy`, Android

//!   `BiometricPrompt.authenticate`, Windows `UserConsentVerifier`, Linux

//!   polkit / PAM) and, when the user responds, parks the outcome in the

//!   async result channel [`push_biometric_result`]. It also writes the

//!   sync availability probe via [`BiometricManager::set_availability`].

//!

//! - The dll **layout pass** drains the channel once per frame via

//!   [`drain_biometric_results`] and applies the latest through

//!   [`BiometricManager::set_last_result`]; callbacks then read it with

//!   `CallbackInfo::get_biometric_result()` and the device capability via

//!   the sync availability accessor.

//!

//! No platform deps (SUPER_PLAN_2 §0.5); the async-result channel is

//! copied verbatim from `geolocation.rs`.

use alloc::vec::Vec;

// `BiometricKind` / `BiometricResult` / `BiometricPrompt` live in

// `azul-core` so the request config can cross the FFI without a cyclic

// dep on `azul-layout`. Re-exported here for the existing

// `azul_layout::managers::biometric::*` import paths.

pub use azul_core::biometric::{BiometricKind, BiometricPrompt, BiometricResult};

/// Cross-platform biometric state. One per `App` — the OS exposes a

/// single per-process authentication surface, not per-window.

#[derive(Debug, Clone, PartialEq)]

pub struct BiometricManager {

    /// Outcome of the most recent `request_biometric_auth`, or `None`

    /// until the first request completes. Read by callbacks via

    /// `CallbackInfo::get_biometric_result()`.

    pub last_result: Option<BiometricResult>,

    /// Cached sync availability probe — what the device *can* do

    /// (`Face` / `Fingerprint` / `Iris` / `NotAvailable`). The backend

    /// refreshes it on startup and after enrollment changes; callbacks

    /// read it to decide whether to even offer biometric unlock.

    pub availability: BiometricKind,

}

impl Default for BiometricManager {

}

impl BiometricManager {

    /// Most recent auth outcome, or `None` until the first request

    /// resolves.

    /// Device capability probe (sync). `NotAvailable` until the backend

    /// reports otherwise.

    /// `true` if the device has a usable biometric sensor.

    /// Platform backend records the device's biometric capability.

    /// Returns `true` if it changed, so the caller can relayout to

    /// reflect a newly-enrolled (or newly-removed) sensor.

    /// Apply the outcome the backend delivered for the user's request.

    /// Returns `true` if it differs from the previous outcome (so the

    /// window can be marked dirty to re-render the unlocked / denied

    /// state).

    /// `true` if the last attempt unlocked successfully (biometric match

    /// or OS passcode fallback). Convenience for the vault gate.

}

// ────────── Async result channel (platform backend → manager) ─────────

//

// The OS prompt's reply block / `AuthenticationCallback` fires on an

// arbitrary thread with no handle to the live `BiometricManager` (it

// lives inside the window's `LayoutWindow`). The backend parks each

// result here; the layout pass drains it once per frame via

// [`drain_biometric_results`] and applies the latest through

// [`BiometricManager::set_last_result`]. Pure Rust — no platform

// dependency (SUPER_PLAN_2 §0.5). Mirrors the geolocation manager's

// async-fix channel.

static PENDING_RESULTS: std::sync::Mutex<Vec<BiometricResult>> =

    std::sync::Mutex::new(Vec::new());

/// Park a biometric result delivered by a platform backend (in the dll).

/// Thread-safe; recovers from a poisoned lock so one panicking applier

/// can't wedge delivery forever.

/// Drain every result parked by [`push_biometric_result`], in arrival

/// order. Called once per layout pass; the caller applies them through

/// [`BiometricManager::set_last_result`] (the last one wins).

// ────────── Request channel (callback → platform backend) ─────────────

//

// The reverse direction: a callback (e.g. an unlock button's `on_click`)

// calls `CallbackInfo::request_biometric_auth(prompt)`, which parks the

// prompt here. The dll layout pass drains it via

// [`drain_biometric_requests`] and dispatches each to the native backend

// (`dll::desktop::extra::biometric::request`), which shows the OS prompt

// and later parks the outcome back through [`push_biometric_result`].

// Decoupling via a channel keeps the request callable from any callback

// without threading the window's backend handle through `CallbackInfo`,

// and keeps `azul-layout` platform-free (SUPER_PLAN_2 §0.5).

static PENDING_REQUESTS: std::sync::Mutex<Vec<BiometricPrompt>> =

    std::sync::Mutex::new(Vec::new());

/// Queue a biometric-auth request from a callback. Picked up by the dll

/// layout pass and dispatched to the native prompt. Thread-safe;

/// poison-recovering.

/// Drain every request queued by [`push_biometric_request`], in arrival

/// order. Called once per layout pass; the dll dispatches each to the

/// platform backend.

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    #[test]

        // Same value again — no change.

        // Different value — change.

    #[test]

        // Re-applying the same outcome is not a change.

        // A new outcome is a change, and Authenticated is a success.

    #[test]

        // Cancelled / Failed / Unavailable / Error are not successes.

        ] {

        }

    #[test]

        // The channel is process-global; clear any residue first.

        // Applying them reflects in last_result() — what the layout pass does.

            Some(BiometricResult::Authenticated),

        );

        // A second drain is empty — the queue was taken, not copied.

    #[test]

        // Process-global; clear residue first.

        // A second drain is empty — the queue was taken, not copied.

    #[test]

}