-module(kryptos@ecdsa).
-compile([no_auto_import, nowarn_unused_vars, nowarn_unused_function, nowarn_nomatch, inline]).
-define(FILEPATH, "src/kryptos/ecdsa.gleam").
-export([sign/3, verify/4]).

-if(?OTP_RELEASE >= 27).
-define(MODULEDOC(Str), -moduledoc(Str)).
-define(DOC(Str), -doc(Str)).
-else.
-define(MODULEDOC(Str), -compile([])).
-define(DOC(Str), -compile([])).
-endif.

?MODULEDOC(
    " Elliptic Curve Digital Signature Algorithm (ECDSA).\n"
    "\n"
    " ECDSA provides digital signatures using elliptic curve cryptography,\n"
    " offering strong security with smaller key sizes compared to RSA.\n"
    "\n"
    " ## Example\n"
    "\n"
    " ```gleam\n"
    " import kryptos/ec\n"
    " import kryptos/ecdsa\n"
    " import kryptos/hash\n"
    "\n"
    " let #(private_key, public_key) = ec.generate_key_pair(ec.P256)\n"
    " let message = <<\"hello world\":utf8>>\n"
    " let signature = ecdsa.sign(private_key, message, hash.Sha256)\n"
    " let valid = ecdsa.verify(public_key, message, signature, hash.Sha256)\n"
    " // valid == True\n"
    " ```\n"
).

-file("src/kryptos/ecdsa.gleam", 38).
?DOC(
    " Signs a message using ECDSA with the specified hash algorithm.\n"
    "\n"
    " The message is hashed internally using the provided algorithm before signing.\n"
    " Signatures may be non-deterministic depending on platform (Erlang uses random\n"
    " nonces, some platforms may use deterministic RFC 6979 nonces).\n"
    "\n"
    " ## Parameters\n"
    " - `private_key`: An elliptic curve private key from `ec.generate_key_pair`\n"
    " - `message`: The message to sign (any length)\n"
    " - `hash`: The hash algorithm to use (e.g., `Sha256`, `Sha384`, `Sha512`)\n"
    "\n"
    " ## Returns\n"
    " A DER-encoded ECDSA signature.\n"
).
-spec sign(kryptos@ec:private_key(), bitstring(), kryptos@hash:hash_algorithm()) -> bitstring().
sign(Private_key, Message, Hash) ->
    kryptos_ffi:ecdsa_sign(Private_key, Message, Hash).

-file("src/kryptos/ecdsa.gleam", 60).
?DOC(
    " Verifies an ECDSA signature against a message.\n"
    "\n"
    " The message is hashed internally using the provided algorithm before\n"
    " verification. The same hash algorithm used during signing must be used\n"
    " for verification.\n"
    "\n"
    " ## Parameters\n"
    " - `public_key`: The elliptic curve public key corresponding to the signing key\n"
    " - `message`: The original message that was signed\n"
    " - `signature`: The DER-encoded signature to verify\n"
    " - `hash`: The hash algorithm used during signing\n"
    "\n"
    " ## Returns\n"
    " `True` if the signature is valid, `False` otherwise.\n"
).
-spec verify(
    kryptos@ec:public_key(),
    bitstring(),
    bitstring(),
    kryptos@hash:hash_algorithm()
) -> boolean().
verify(Public_key, Message, Signature, Hash) ->
    kryptos_ffi:ecdsa_verify(Public_key, Message, Signature, Hash).