namespace XFESystem.Tls;

/// <summary>Fill the complete buffer from a verified kernel CSPRNG, or throw.</summary>
public delegate void TlsRandomFill(Span<byte> destination);

/// <summary>
/// Explicit bridge to kernel-owned security services. Neither delegate has a
/// host OS, compile timestamp, deterministic seed, or jitter-only fallback.
/// The platform must verify UTC provenance and RNG health before supplying it.
/// </summary>
public sealed class TlsPlatformSecurityContext : ITlsSecurityContext
{
    private readonly Func<DateTime> readVerifiedUtc;
    private readonly TlsRandomFill fillVerifiedRandom;

    public TlsPlatformSecurityContext(Func<DateTime> readVerifiedUtc, TlsRandomFill fillVerifiedRandom)
    {
        this.readVerifiedUtc = readVerifiedUtc ?? throw new ArgumentNullException(nameof(readVerifiedUtc));
        this.fillVerifiedRandom = fillVerifiedRandom ?? throw new ArgumentNullException(nameof(fillVerifiedRandom));
    }

    public DateTime UtcNow
    {
        get
        {
            DateTime utc = readVerifiedUtc();
            TlsSecurity.ValidateUtc(utc);
            return utc;
        }
    }

    public void FillRandom(Span<byte> destination)
    {
        try { fillVerifiedRandom(destination); }
        catch
        {
            // A source may fail after partially filling the destination.
            // Never return that partial result to the TLS implementation.
            destination.Clear();
            throw;
        }
    }
}