package com.atlassian.bitbucket.mesh.auth;

import javax.annotation.Nonnull;
import javax.annotation.Nullable;

public interface Authenticator {

    /**
     * Authenticates the provided token, verifying it has been signed by a known key and claims the specified
     * subject. If the token is expired or invalid, or if it is not signed with a known key, or if it claims
     * another subject, it is rejected.
     *
     * @param subject the expected subject for the token to claim
     * @param token   the token to authenticate
     * @return the authenticated {@link Principal}, or {@code null} if the token was rejected
     */
    @Nullable
    Principal authenticate(@Nonnull String subject, @Nonnull String token);

    /**
     * Signs a token claiming the specified subject.
     *
     * @param subject the subject to claim on the signed token
     * @return the signed token
     */
    @Nonnull
    String sign(@Nonnull String subject);
}
