internal

type ArchiveLimits struct {
	// MaxDecompressionRatio is the maximum allowed ratio of uncompressed to
	// compressed size for a single ZIP entry. TAR entries are not ratio-checked
	// because TAR stores uncompressed data. A ratio of 100 means a 1KB
	// compressed entry may decompress to at most 100KB.
	MaxDecompressionRatio int64

	// MaxTotalSize is the maximum total bytes that may be extracted from a
	// single archive across all entries.
	MaxTotalSize int64

	// MaxEntryCount is the maximum number of entries that will be processed
	// from a single archive. Legitimate certificate archives rarely exceed
	// a few hundred entries.
	MaxEntryCount int

	// MaxEntrySize is the maximum allowed size of a single decompressed entry.
	// Entries exceeding this are skipped. Typically set from --max-file-size.
	MaxEntrySize int64
}

type BundleConfig struct {
	CommonNames []string       `yaml:"commonNames"`
	BundleName  string         `yaml:"bundleName"`
	Subject     *SubjectConfig `yaml:"subject,omitempty"`
}

type BundlesYAML struct {
	DefaultSubject *SubjectConfig `yaml:"defaultSubject,omitempty"`
	Bundles        []BundleConfig `yaml:"bundles"`
}

type CSROptions struct {
	TemplatePath string // JSON template file
	CertPath     string // PEM cert as template
	CSRPath      string // PEM CSR as template

	KeyPath   string // Existing key (PEM)
	Algorithm string // rsa, ecdsa, ed25519 (default: ecdsa)
	Bits      int    // RSA bits (default: 4096)
	Curve     string // ECDSA curve (default: P-256)

	OutPath   string   // Output directory (default: ".")
	Passwords []string // Passwords for encrypted keys
}

type CSRResult struct {
	CSRPEM  string
	KeyPEM  string // empty if existing key was provided
	CSRFile string // empty in stdout mode
	KeyFile string // empty in stdout mode
}

type ChainCert struct {
	Subject string `json:"subject"`
	Expiry  string `json:"expiry"`
	SKI     string `json:"subject_key_id,omitempty"`
	IsRoot  bool   `json:"is_root,omitempty"`
}

type ContainerContents = certstore.ContainerContents

type InspectResult struct {
	Type      string   `json:"type"`
	Subject   string   `json:"subject,omitempty"`
	Issuer    string   `json:"issuer,omitempty"`
	Serial    string   `json:"serial,omitempty"`
	NotBefore string   `json:"not_before,omitempty"`
	NotAfter  string   `json:"not_after,omitempty"`
	CertType  string   `json:"cert_type,omitempty"`
	Expired   *bool    `json:"expired,omitempty"`
	Trusted   *bool    `json:"trusted,omitempty"`
	IsCA      *bool    `json:"is_ca,omitempty"`
	KeyAlgo   string   `json:"key_algorithm,omitempty"`
	KeySize   string   `json:"key_size,omitempty"`
	SANs      []string `json:"sans,omitempty"`
	KeyUsages []string `json:"key_usages,omitempty"`
	EKUs      []string `json:"ekus,omitempty"`
	SHA256    string   `json:"sha256_fingerprint,omitempty"`
	SHA1      string   `json:"sha1_fingerprint,omitempty"`
	SKI       string   `json:"subject_key_id,omitempty"`
	SKILegacy string   `json:"subject_key_id_sha1,omitempty"`
	AKI       string   `json:"authority_key_id,omitempty"`
	SigAlg    string   `json:"signature_algorithm,omitempty"`
	KeyType   string   `json:"key_type,omitempty"`

	// CSR-specific fields. Populated only when Type == "csr".
	CSRSubject string `json:"csr_subject,omitempty"`
	// contains filtered or unexported fields
}

type KeygenOptions struct {
	Algorithm string
	Bits      int
	Curve     string
	OutPath   string
	CN        string
	SANs      []string
}

type KeygenResult struct {
	KeyPEM  string
	PubPEM  string
	CSRPEM  string // empty if no CSR generated
	KeyFile string // empty in stdout mode
	PubFile string // empty in stdout mode
	CSRFile string // empty in stdout mode
}

type ProcessArchiveInput struct {
	ArchivePath string
	Data        []byte
	Format      string
	Limits      ArchiveLimits
	Store       *certstore.MemStore
	Passwords   []string
}

type SubjectConfig struct {
	Country            []string `yaml:"country,omitempty"`            // C
	Province           []string `yaml:"province,omitempty"`           // ST
	Locality           []string `yaml:"locality,omitempty"`           // L
	Organization       []string `yaml:"organization,omitempty"`       // O
	OrganizationalUnit []string `yaml:"organizationalUnit,omitempty"` // OU
}

type VerifyInput struct {
	Cert           *x509.Certificate
	Key            crypto.PrivateKey
	ExtraCerts     []*x509.Certificate
	CustomRoots    []*x509.Certificate
	CheckKeyMatch  bool
	CheckChain     bool
	ExpiryDuration time.Duration
	TrustStore     string
}

type VerifyResult struct {
	Subject     string      `json:"subject"`
	SANs        []string    `json:"sans,omitempty"`
	NotAfter    string      `json:"not_after"`
	SKI         string      `json:"subject_key_id,omitempty"`
	KeyMatch    *bool       `json:"key_match,omitempty"`
	KeyMatchErr string      `json:"key_match_error,omitempty"`
	KeyInfo     string      `json:"key_info,omitempty"`
	ChainValid  *bool       `json:"chain_valid,omitempty"`
	ChainErr    string      `json:"chain_error,omitempty"`
	Chain       []ChainCert `json:"chain,omitempty"`
	Expiry      *bool       `json:"expires_within,omitempty"`
	ExpiryInfo  string      `json:"expiry_info,omitempty"`
	Errors      []string    `json:"errors,omitempty"`
}