certs

type Cert struct {
	ThingID        string    `json:"thing_id" mapstructure:"thing_id"`
	ClientCert     string    `json:"client_cert" mapstructure:"certificate"`
	IssuingCA      string    `json:"issuing_ca" mapstructure:"issuing_ca"`
	CAChain        []string  `json:"ca_chain" mapstructure:"ca_chain"`
	ClientKey      string    `json:"client_key" mapstructure:"private_key"`
	PrivateKeyType string    `json:"private_key_type" mapstructure:"private_key_type"`
	KeyBits        int       `json:"key_bits" mapstructure:"key_bits"`
	Serial         string    `json:"serial" mapstructure:"serial_number"`
	ExpiresAt      time.Time `json:"expires_at" mapstructure:"-"`
	Downloaded     bool      `json:"downloaded" mapstructure:"downloaded"`
}

type CertEvent struct {
	ThingID    string   `json:"thing_id"`
	ClientCert string   `json:"client_cert"`
	ClientKey  string   `json:"client_key"`
	IssuingCA  string   `json:"issuing_ca"`
	CAChain    []string `json:"ca_chain"`
	Serial     string   `json:"serial"`
	ExpiresAt  string   `json:"expires_at"`
}

type CertScheduler struct {
	// contains filtered or unexported fields
}

type Config struct {
	LogLevel       string
	ClientTLS      bool
	CaCerts        string
	HTTPPort       string
	ServerCert     string
	ServerKey      string
	CertsURL       string
	JaegerURL      string
	AuthURL        string
	AuthTimeout    time.Duration
	SignTLSCert    tls.Certificate
	SignX509Cert   *x509.Certificate
	SignRSABits    int
	SignHoursValid string
	CRLPath        string
}

type Page struct {
	Total uint64
	Certs []Cert
}

type Repository interface {
	// Save  saves cert for thing into database
	Save(ctx context.Context, cert Cert) (string, error)

	// RetrieveAll retrieve issued certificates
	RetrieveAll(ctx context.Context, offset, limit uint64) (Page, error)

	// Remove removes certificate from DB for a given serial
	Remove(ctx context.Context, serial string) error

	// RetrieveByThing retrieves issued certificates for a given thing ID
	RetrieveByThing(ctx context.Context, thingID string, offset, limit uint64) (Page, error)

	// RetrieveBySerial retrieves a certificate for a given serial
	RetrieveBySerial(ctx context.Context, serial string) (Cert, error)

	// RetrieveExpiring retrieves certificates that expire within the given duration.
	RetrieveExpiring(ctx context.Context, expiresWithin time.Duration) ([]Cert, error)

	// RetrieveRevokedCerts retrieves all revoked certificates
	RetrieveRevokedCerts(ctx context.Context) ([]RevokedCert, error)

	// MarkDownloaded marks a certificate as downloaded
	MarkDownloaded(ctx context.Context, serial string) error
}

type Revoke struct {
	RevocationTime time.Time `mapstructure:"revocation_time"`
}

type RevokedCert struct {
	Serial    string    `db:"serial"`
	ThingID   string    `db:"thing_id"`
	RevokedAt time.Time `db:"revoked_at"`
}

type Service interface {
	// IssueCert issues certificate for given thing id if access is granted with token.
	IssueCert(ctx context.Context, token, thingID, ttl string, keyBits int, keyType string) (Cert, error)

	// RotateCert rotates the certificate by revoking the cert with given serial and issuing a new one.
	RotateCert(ctx context.Context, token, serial, thingID, ttl string, keyBits int, keyType string) (Cert, error)

	// ListCerts lists certificates issued for a given thing ID.
	ListCerts(ctx context.Context, token, thingID string, offset, limit uint64) (Page, error)

	// ListSerials lists certificate serial numbers issued for a given thing ID.
	ListSerials(ctx context.Context, token, thingID string, offset, limit uint64) (Page, error)

	// ViewCert retrieves the certificate issued for a given serial ID.
	ViewCert(ctx context.Context, token, serial string) (Cert, error)

	// RevokeCert revokes a certificate for a given serial ID.
	RevokeCert(ctx context.Context, token, serial string) (Revoke, error)

	// RenewCert extends the expiration date of a certificate.
	RenewCert(ctx context.Context, token, serial string) (Cert, error)

	// DownloadCert retrieves the full certificate data (key, cert, CA) and marks it as downloaded.
	// Authenticates via thingKey (device self-provisioning); serial must belong to the thing.
	DownloadCert(ctx context.Context, thingKey domain.ThingKey, serial string) (Cert, error)
}