secrets

type AuditRecord struct {
	Seq      uint64 `json:"seq"`
	Ts       uint64 `json:"ts"`
	Op       string `json:"op"`
	Caller   string `json:"caller"`
	Decision string `json:"decision"`
	Reason   string `json:"reason,omitempty"`
}

type CreateParams struct {
	Issuer     string   // IdP origin
	Bearer     string   // the user's access token
	Sub        string   // the user's subject (owner of the key)
	Handle     string   // vault key handle, must fall under users/<sub>/
	Secret     []byte   // the key material
	Exportable bool     // whether the owner may export it later
	Endpoints  []string // constellation vault endpoints (host:port)
	Threshold  int      // Shamir k (e.g. 2 of n)
	MRENCLAVE  string   // expected vault MRENCLAVE (hex)
	AttServer  string   // attestation server verify endpoint
	AttToken   string   // aud=attestation-server bearer for quote verification
}

type ExportParams struct {
	Issuer        string           // IdP origin
	Bearer        string           // the user's access token (owner)
	Sub           string           // the user's subject (owner of the key)
	Handle        string           // vault key handle (users/<sub>/...)
	Endpoints     []string         // constellation vault endpoints (host:port)
	Threshold     int              // Shamir k (vaults needed to reconstruct)
	MRENCLAVE     string           // expected vault MRENCLAVE (hex)
	AttServer     string           // attestation server verify endpoint
	AttToken      string           // aud=attestation-server bearer for quote verification
	RequireStepUp bool             // when set, drive an operation-bound WebAuthn step-up (Assert)
	Assert        StepUpAssertFunc // produces the WebAuthn step-up assertion
	// GenerationSize > 0 means the per-vault material is generation-prefixed
	// (`generation(GenerationSize) || share`), the layout the enclave-os manager
	// uses for app volume DEKs. 0 (default) = raw shares (user secrets).
	GenerationSize int
}

type ExportResult struct {
	Handle      string `json:"handle"`
	Retrieved   int    `json:"retrieved"` // vaults that returned a share
	Total       int    `json:"total"`
	Threshold   int    `json:"threshold"`
	Fingerprint string `json:"fingerprint"` // sha256: of the reconstructed key
}

type PublicKeyResult struct {
	KeyType   string `json:"key_type"`
	PublicKey []byte `json:"-"`
	Vault     string `json:"vault"`
}

type Result struct {
	Handle     string `json:"handle"`
	Created    int    `json:"created"` // vaults that accepted a share
	Total      int    `json:"total"`
	Threshold  int    `json:"threshold"`
	Exportable bool   `json:"exportable"`
	Thumbprint string `json:"cnf_x5t_s256"`
	Endpoint   string `json:"endpoint,omitempty"` // single-enclave keys: the holding vault
}

type SignResult struct {
	Signature []byte `json:"-"`
	Alg       string `json:"alg"`
	Vault     string `json:"vault"`
}

type StepUpAssertFunc func(ctx context.Context, optionsJSON []byte) (assertionJSON []byte, err error)

type VaultAddressing struct {
	Handle    string
	Endpoints []string
	MRENCLAVE string
	AttServer string
	Threshold int
}

type VaultCreateParams struct {
	Sub        string // the key owner's subject
	Secret     []byte // the key material
	Exportable bool
	AttToken   string // aud=attestation-server bearer for quote verification
	// MintGrant asks the platform to mint a grant for a key bound to the agent's
	// holder-of-key cnf, returning the grant and the constellation addressing.
	MintGrant func(ctx context.Context, cnf string) (grant string, addr VaultAddressing, err error)
}

type VaultOpParams struct {
	Handle     string   // the key handle (vaults/<vault-id>/<name>)
	Endpoints  []string // constellation vault endpoints to try (the holder is one of them)
	MRENCLAVE  string   // expected vault MRENCLAVE (hex)
	AttServer  string   // attestation server verify endpoint
	AttToken   string   // aud=attestation-server bearer for quote verification
	OwnerToken string   // the owner's OIDC bearer (aud = the vault audience)
}