"""Stub identity adapters (§2.3): Base, Google, EUDI — registered behind the IdentityVerifier interface so
the ingress/router treat them uniformly, but NOT YET IMPLEMENTED. Each `verify` returns `None` (fail-closed),
so a credential from one of these methods cannot raise assurance until its real adapter lands — it is never
silently trusted. When implemented, only these files change; the ingress/router are untouched.
"""

from __future__ import annotations

from typing import Optional

from cl.interfaces.identity import IdentityVerifier, VerifiedIdentity


class _StubVerifier(IdentityVerifier):
    _METHOD = "stub"

    def method(self) -> str:
        return self._METHOD

    def verify(self, signing_input: bytes, signature: bytes, key_ref: str) -> Optional[VerifiedIdentity]:
        return None  # not implemented — fail-closed (never a phantom assurance)


class BaseVerifier(_StubVerifier):
    _METHOD = "base"


class GoogleVerifier(_StubVerifier):
    _METHOD = "google"


class EudiVerifier(_StubVerifier):
    _METHOD = "eudi"
