ca

type CAInfo struct {
	ID, Name, Kind, Status, KeyMode string
	Parent                          string // name; "" for a root
	BaseURL                         string
	CurrentGeneration               int64 // 0 = none signed yet
	PathLen                         *int64
	CRLDays, MaxValidityDays        int64
	NameConstraints                 []string // "permitted dns homelab.lan"
	NameConstraintsCritical         bool
	EKULimit                        []string // names, or OIDs for unnamed ones
	Generations                     []GenerationInfo
}

type CAResult struct {
	ID, Name, Status string
	Generation       int64
	CertDER          []byte // nil while the generation waits for its offline signature
	Fingerprint      string // SHA-256 of CertDER, upper-case hex
	Offline          *OfflineBundle
	CRL              *CRLResult // the first CRL of a generation whose key is on this server
	Notes, Warnings  []string
}

type CASettings struct {
	Name            string // immutable: part of every AIA/CRL URL
	BaseURL         string // public base URL for AIA/CRL; immutable once used
	CRLDays         int    // 0 = default for the kind
	MaxValidityDays int    // cap for leaves; 0 = 397
}

type CRLResult struct {
	CA                     string
	Generation             int64
	Number                 int64
	ThisUpdate, NextUpdate time.Time
	Entries                int
	DER                    []byte
}

type CRLStatus struct {
	CA                     string
	Generation             int64
	KeyMode                string
	Number                 int64
	Source                 string
	ThisUpdate, NextUpdate time.Time
	State                  string
	// Unpublished counts revocations not on the newest CRL yet: they take
	// effect only once a CRL lists them.
	Unpublished int
}

type CSRInspection struct {
	Subject             string
	CommonName          string
	DNSNames, IPs       []string
	Emails, URIs        []string
	KeyAlgorithm        string
	SignatureValid      bool
	RequestedExtensions []string
	Problems, Warnings  []string
}

type CertificateFilter struct {
	CAID, Preset, Status string
	ExpiresBefore        time.Time
	// Search is a substring of CN, serial or a SAN – no wildcards.
	Search string
	Cursor string // the last ID of the previous page
	Limit  int    // 0 = DefaultPageSize; at most MaxPageSize
}

type CertificateInfo struct {
	ID, Source, Status             string
	CAID, CAName                   string // "" for external certificates
	CAGeneration                   int64
	Preset                         string
	Serial, Subject, CommonName    string
	DNSNames, IPs, Emails, URIs    []string
	NotBefore, NotAfter, CreatedAt time.Time
	KeyAlgorithm, Fingerprint      string
	KeyStored                      bool
	RenewalOf, RequestedBy         string
	RevocationReason               string
	RevokedAt, InvalidityDate      *time.Time
	// contains filtered or unexported fields
}

type CertificatePage struct {
	Items      []CertificateInfo
	NextCursor string // "" = last page
}

type Counts struct {
	Valid, Expiring, Expired, Revoked int64
}

type DeniedError struct {
	Reasons []string
	// DroppedCSRNames: CSR names the preset doesn't take ("type:value"),
	// reported even when the request is denied for another reason.
	DroppedCSRNames []string
	// Cause is the underlying refusal, e.g. authz.ErrStepUpRequired.
	Cause error
}

type Engine struct {
	PKI     *sql.DB // writer of tenants/<t>/pki.db
	Audit   *sql.DB // writer of tenants/<t>/audit.db: refused requests are logged directly
	Scope   string  // audit scope of Audit, store.TenantScope(tenant)
	Keys    *keys.Keyring
	Presets *preset.Set
	Clock   clock.Clock
	// ServerKeygen reports the tenant switch allow_server_keygen (system.db).
	// It is asked per request, so a change applies at once.
	ServerKeygen func(context.Context) (bool, error)
	// Wake, if set, is called after a commit with an outbox row.
	Wake func()
	// Rand is the randomness for serials and keys; nil = crypto/rand.
	Rand io.Reader
	// Log, if set, gets CRL renewals and CRL warnings (process log).
	Log *slog.Logger
}

type Export struct {
	Data                  []byte
	ContentType, FileName string
	KeyDeleted            bool
}

type ExportRequest struct {
	ID, Format string
	// Password protects a PKCS#12 file (at least pkcs12.MinPassword characters).
	Password string
	// DeleteKey destroys the key on the server after the export.
	DeleteKey bool
	Who       keys.Who
}

type GenerationInfo struct {
	Generation          int64
	Current, Pending    bool
	KeyAlgorithm        string
	Subject             string
	Serial, Fingerprint string
	NotBefore, NotAfter string
	Issuer              string // "root/1"; "" for a root
	CertURL, CRLURL     string // where MyOwnPKI publishes it
	// Warnings are found in the certificate itself, e.g. AIA/CDP URLs that
	// differ from what MyOwnPKI serves (an offline-signed certificate).
	Warnings []string
	// Revoked is "<reason> on <date>" for a revoked generation.
	Revoked string
	// CRL is the newest CRL; filled by AttachCRLStatus (it needs the time).
	CRL *CRLStatus
}

type ImportJob struct {
	ID, Kind, Status   string
	DryRun             bool
	StartedAt, EndedAt time.Time
	StartedBy          string
	Report             *LegacyImportReport
	Error              string `json:"-"` // not stored apart: Report.Problems has it
}

type ImportRootRequest struct {
	CASettings
	CertPEM []byte
	Who     keys.Who
}

type IntermediateRequest struct {
	CASettings
	Parent          string
	Subject         Subject
	KeyAlgorithm    string // "" = ecdsa-p384
	ValidityDays    int    // 0 = 3650, never beyond the parent
	PathLen         int    // 0 = may only issue end-entity certificates
	NameConstraints NameConstraints
	EKULimit        []string // EKU names or OIDs; empty = no limit
	Who             keys.Who
}

type Issued struct {
	ID           string
	SerialHex    string
	Fingerprint  string // SHA-256, upper-case hex
	CertDER      []byte
	Chain        [][]byte // issuing CA first, root last
	KeyID        string   // server-generated key; "" for a CSR
	KeyAlgorithm string
	NotBefore    time.Time
	NotAfter     time.Time
	// Notes say what a default changed (validity shortened, base domain added).
	Notes []string
	// DroppedCSRNames are names from the CSR the preset doesn't take, as
	// "type:value" – shown to the requester and written to the audit log.
	DroppedCSRNames []string
	// Warnings are compatibility problems that didn't stop the issuance.
	Warnings []string
}

type LegacyCAReport struct {
	Name, Kind, KeyMode, Status string
	ID                          string `json:"id,omitempty"`
	Subject, Fingerprint        string
	Certificates, Revoked       int
	// LastCRLNumber is the newest number pki.sh used; the next CRL gets +1.
	LastCRLNumber int64
	History       int // older certificates of the same key
}

type LegacyImportReport struct {
	DryRun       bool             `json:"dry_run"`
	Imported     bool             `json:"imported"`
	BaseURL      string           `json:"base_url"`
	LegacyURLs   bool             `json:"legacy_urls"`
	CAs          []LegacyCAReport `json:"cas"`
	Certificates int              `json:"certificates"`
	Revoked      int              `json:"revoked"`
	Keys         int              `json:"keys"`
	External     int              `json:"external"`
	Warnings     []string         `json:"warnings"`
	Problems     []string         `json:"problems"`
	CRLs         []CRLResult      `json:"-"`
	// contains filtered or unexported fields
}

type LegacyImportRequest struct {
	PKI *legacy.PKI
	// BaseURL for the AIA/CRL URLs of new certificates; "" = AIA_BASE_URL of
	// pki.conf. With the pki.sh URL, <base>/<name>.crt|.crl stay served.
	BaseURL string
	// RootOnline imports the root key encrypted (default: an offline root –
	// pki.sh stays the offline root tool).
	RootOnline bool
	// DryRun checks everything and writes nothing.
	DryRun bool
	Who    keys.Who
}

type NameConstraints struct {
	PermittedDNS, ExcludedDNS     []string
	PermittedIP, ExcludedIP       []string
	PermittedEmail, ExcludedEmail []string
	PermittedURI, ExcludedURI     []string
	// NotCritical writes the extension non-critical – a compatibility switch
	// for old clients; RFC 5280 requires critical.
	NotCritical bool
}

type Names struct {
	DNS    []string
	IPs    []netip.Addr
	Emails []string
	URIs   []string
}

type OfflineBundle struct {
	CSRPEM    []byte
	ExtConfig string // contents of the extension file
	// Suggested file names: <name>-<generation>.csr / .ext / .crt.
	CSRFile, ExtFile, CertFile string
	Days                       int    // -days for the signature; ends before the parent does
	Digest                     string // matches the root key: sha384 for P-384; "" for Ed25519
	Serial                     string // random 159-bit serial for plain OpenSSL (-set_serial)
	Instructions               string
}

type RenewCertRequest struct {
	ID string
	// CSR is required when the original came from a CSR.
	CSR []byte
	// KeyAlgorithm of a new server key; "" = the original's.
	KeyAlgorithm string
	ValidityDays int
	// RevokePrevious revokes the original as superseded after the renewal
	// (needs certificate.revoke and a fresh step-up, checked first).
	RevokePrevious bool
	Who            keys.Who
}

type RenewRequest struct {
	Name         string
	KeyAlgorithm string // "" = the current algorithm (if allowed for new CAs)
	ValidityDays int
	Who          keys.Who
}

type Renewed struct {
	*Issued
	Revoked *RevokeResult
}

type Request struct {
	CA     string
	Preset string
	// CSR is a PEM certificate request. nil = generate the key on the server.
	CSR []byte
	// KeyAlgorithm for server-side generation; "" = DefaultKeyAlgorithm.
	KeyAlgorithm string

	DNSNames, IPAddresses, EmailAddresses, URIs []string
	// IgnoreCSRNames uses only the names given here and ignores the CSR's
	// names and subject (legacy --no-csr-san).
	IgnoreCSRNames bool
	Subject        Subject
	// SubjectDefaults are the tenant's (O, OU, L, ST, C), the lowest priority.
	SubjectDefaults Subject

	ValidityDays int // 0 = the preset's default
	// CustomKeyUsage and CustomExtKeyUsage: only for customizable presets.
	CustomKeyUsage, CustomExtKeyUsage []string
	RenewalOf                         string // certificate ID, optional
	Who                               keys.Who
}

type RevokeCARequest struct {
	Name           string
	Generation     int64 // 0 = the current generation
	Reason         string
	InvalidityDate *time.Time
	Who            keys.Who
}

type RevokeRequest struct {
	CertificateID string
	Reason        string
	// InvalidityDate: when the key is known or suspected to be compromised
	// (keyCompromise only); nil = not given.
	InvalidityDate *time.Time
	Who            keys.Who
}

type RevokeResult struct {
	Serial    string
	CRL       *CRLResult // nil when no CRL could be signed yet
	Published bool       // false: stored, but not on a CRL yet (sealed server)
	Warnings  []string
}

type RootRequest struct {
	CASettings
	Subject      Subject
	KeyAlgorithm string // "" = ecdsa-p384
	ValidityDays int    // 0 = 7300
	Who          keys.Who
}

type Subject struct {
	CommonName         string
	Organization       string
	OrganizationalUnit string
	Locality           string
	Province           string
	Country            string
}

type UpdateRequest struct {
	Name            string
	CRLDays         int
	MaxValidityDays int
	Who             keys.Who
}