unit PM.Handler.Passkey;

(*
  WebAuthn / Passkey endpoints — stubbed to 501 Not Implemented.

  Why stubbed: full WebAuthn server requires:
    - CBOR decoder for COSE keys + attestation objects
    - DER ASN.1 encoder for ES256/RS256 public keys
    - ECDSA P-256 signature verification (no native Delphi support)
    - Challenge management with constant-time compares
  Roughly 500-700 lines of crypto-sensitive code. The PHP version (api.php
  lines 168-657) handles this with OpenSSL bindings. A faithful Delphi port
  would either bind libssl/libcrypto DLLs or pull in a pure-Pascal EC lib.

  For v1 of the Delphi backend we return 501 with a clear message so the
  frontend gracefully falls back to master password login. The PHP backend
  remains the reference for passkey-enabled deployments.

  When implemented, see:
    api.php :169-211   cbor_decode, derLen, coseToPem
    api.php :537-657   register/begin, register/complete, login/begin, login/complete
*)

interface

implementation

uses
  System.SysUtils,
  IdCustomHTTPServer,
  PM.Router, PM.JSON;

procedure HandleStub(ARequest: TIdHTTPRequestInfo;
  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
begin
  TJSONHelper.SendError(AResponse, 501,
    'Passkey/WebAuthn is not implemented in the Delphi backend yet. ' +
    'Use master-password login, or run the PHP backend for passkey support.');
end;

initialization
  Router.Register('POST', '/passkey/register/begin',    HandleStub);
  Router.Register('POST', '/passkey/register/complete', HandleStub);
  Router.Register('POST', '/passkey/login/begin',       HandleStub);
  Router.Register('POST', '/passkey/login/complete',    HandleStub);

end.