sdjwtvc

type Claim struct {
	// Path indicates the claim(s) being addressed per section 9.1 (REQUIRED)
	// Array of strings, null values, or non-negative integers
	// - string: select key in object
	// - null: select all elements in array
	// - integer: select specific array index
	Path []*string `json:"path"`

	// Display contains locale-specific display information per section 9.2 (OPTIONAL)
	Display []ClaimDisplay `json:"display,omitempty"`

	// SD indicates selective disclosure rules per section 9.4 (OPTIONAL, default: "allowed")
	// Values: "always", "allowed", "never"
	// - "always": Issuer MUST make the claim selectively disclosable
	// - "allowed": Issuer MAY make the claim selectively disclosable
	// - "never": Issuer MUST NOT make the claim selectively disclosable
	// It is RECOMMENDED to use either "always" or "never" to avoid ambiguity.
	SD string `json:"sd,omitempty"`

	// Mandatory indicates if claim must be present per section 9.3 (OPTIONAL, default: false)
	Mandatory bool `json:"mandatory,omitempty"`

	// SVGID is the identifier for SVG template placeholders per section 8.1.2.2 (OPTIONAL)
	// Must be unique, alphanumeric + underscores, cannot start with digit
	SVGID string `json:"svg_id,omitempty"`
}

type ClaimDisplay struct {
	// Locale is the language tag per RFC 5646 (REQUIRED)
	// Per draft-12+ this field is named "locale" in JSON (changed from "lang" in earlier drafts)
	Locale string `json:"locale"`

	// Label is a human-readable label for end users (REQUIRED)
	Label string `json:"label"`

	// Description is a human-readable description for end users (OPTIONAL)
	Description string `json:"description,omitempty"`
}

type Client struct {
	// HTTPClient is the HTTP client used for outbound requests (e.g. VCTM
	// fetches). When nil, a default client with a 30-second timeout is used.
	HTTPClient *http.Client
}

type CredentialCache struct {
	Claims     []Discloser    `json:"claims"`
	Credential map[string]any `json:"credential"`
}

type CredentialOptions struct {
	// DecoyDigests: number of decoy digests to add per _sd array (§4.2.5)
	DecoyDigests int
	// ExpirationDays: number of days until credential expires (default: 365)
	ExpirationDays int
	// TokenStatusList contains the Token Status List reference for credential revocation per draft-ietf-oauth-status-list
	TokenStatusList *TokenStatusListReference
	// Integrity is the pre-computed SRI hash of the VCTM document (e.g. "sha256-...").
	// When non-empty it is set as the "vct#integrity" claim in the issued credential
	// per SD-JWT VC draft-14 Section 6.
	Integrity string
}

type Discloser struct {
	Salt      string `json:"-"`
	ClaimName string `json:"claim_name"` // Empty for array elements
	Value     any    `json:"value"`
	IsArray   bool   `json:"-"` // True for array element disclosures
}

type Disclosure struct {
	Salt  string // Random salt for privacy
	Claim string // Claim name
	Value any    // Claim value
	Raw   string // Raw disclosure string
	Hash  string // Base64url-encoded hash
}

type KeyBindingJWT struct {
	Nonce    string `json:"nonce"`             // REQUIRED: ensures freshness
	Audience string `json:"aud"`               // REQUIRED: intended receiver
	IssuedAt int64  `json:"iat"`               // REQUIRED: time of KB-JWT creation
	SDHash   string `json:"sd_hash,omitempty"` // REQUIRED: hash of SD-JWT
}

type KeyResolver interface {
	// ResolveKey resolves a public key for the given issuer and key ID.
	ResolveKey(ctx context.Context, issuer string, keyID string) (crypto.PublicKey, error)
}

type Logo struct {
	// URI pointing to the image (REQUIRED)
	URI string `json:"uri"`

	// URIIntegrity provides Subresource Integrity protection per section 7 (OPTIONAL)
	URIIntegrity string `json:"uri#integrity,omitempty"`

	// AltText is alternative text for the image (OPTIONAL)
	AltText string `json:"alt_text,omitempty"`
}

type ParsedCredential struct {
	// Claims contains the credential claims (base JWT claims plus disclosed selective disclosures)
	Claims map[string]any
	// Disclosures contains the raw selective disclosure strings
	Disclosures []string
	// Header contains the JWT header
	Header map[string]any
	// Signature is the JWT signature
	Signature string
	// KeyBinding contains the key binding JWT parts if present
	KeyBinding []string
}

type Rendering struct {
	// Simple contains basic rendering properties per section 8.1.1 (OPTIONAL)
	// Used for applications that don't support SVG rendering
	Simple SimpleRendering `json:"simple"`

	// SVGTemplates contains SVG-based rendering per section 8.1.2 (OPTIONAL)
	// Array of SVG templates with different properties (landscape/portrait, light/dark, etc.)
	SVGTemplates []SVGTemplates `json:"svg_templates,omitempty"`
}

type SDJWTHandler struct {
	// contains filtered or unexported fields
}

type SDJWTHandlerOption func(*SDJWTHandler)

type SDJWTVerificationResult struct {
	Valid           bool
	Issuer          string
	Subject         string
	VCT             string // Verifiable Credential Type
	Claims          map[string]any
	DisclosedClaims map[string]any
	KeyBindingValid bool
	ExpiresAt       *time.Time
	IssuedAt        *time.Time
	VCTM            *VCTM
}

type SVGTemplateProperties struct {
	// Orientation: "portrait" or "landscape" (OPTIONAL)
	Orientation string `json:"orientation,omitempty"`

	// ColorScheme: "light" or "dark" (OPTIONAL)
	ColorScheme string `json:"color_scheme,omitempty"`

	// Contrast: "normal" or "high" (OPTIONAL)
	Contrast string `json:"contrast,omitempty"`
}

type SVGTemplates struct {
	// URI pointing to the SVG template (REQUIRED)
	URI string `json:"uri"`

	// URLIntegrity provides Subresource Integrity protection per section 7 (OPTIONAL)
	// Note: Field name uses "URL" but JSON uses "uri#integrity" to match spec
	URLIntegrity string `json:"uri#integrity,omitempty"`

	// Properties specifies template properties per section 8.1.2.1 (OPTIONAL for single template, REQUIRED for multiple)
	Properties SVGTemplateProperties `json:"properties"`
}

type Signer interface {
	Sign(ctx context.Context, data []byte) ([]byte, error)
	Algorithm() string
	KeyID() string
	PublicKey() any
}

type SimpleRendering struct {
	// Logo contains logo information (OPTIONAL per section 8.1.1.1)
	Logo Logo `json:"logo"`

	// BackgroundImage contains background image information (OPTIONAL per section 8.1.1.2)
	BackgroundImage *Logo `json:"background_image,omitempty"`

	// BackgroundColor is an RGB color value per W3C CSS Color (OPTIONAL per section 8.1.1)
	BackgroundColor string `json:"background_color,omitempty"`

	// TextColor is an RGB color value per W3C CSS Color (OPTIONAL per section 8.1.1)
	TextColor string `json:"text_color,omitempty"`
}

type StaticKeyResolver struct {
	Key crypto.PublicKey
}

type Token string

type TokenStatusListReference struct {
	// Index is the index within the section for this credential's status
	Index int64
	// URI is the full Status List Token URI (e.g., https://example.com/statuslists/0)
	URI string
}

type VCTM struct {
	// VCT is the verifiable credential type identifier (REQUIRED per section 6.2)
	// Must match the vct claim value in the SD-JWT VC
	VCT string `json:"vct"`

	// Name is a human-readable name for developers (OPTIONAL per section 6.2)
	Name string `json:"name,omitempty"`

	// Description is a human-readable description for developers (OPTIONAL per section 6.2)
	Description string `json:"description,omitempty"`

	// Comment allows for additional developer notes (extension)
	Comment string `json:"$comment,omitempty"`

	// Display contains rendering information per section 8
	// Array of display objects for different locales (OPTIONAL per section 6.2)
	Display []VCTMDisplay `json:"display,omitempty"`

	// Claims contains claim metadata per section 9
	// Array of claim information for validation and display (OPTIONAL per section 6.2)
	Claims []Claim `json:"claims,omitempty"`

	// Extends references another type that this type extends (OPTIONAL per section 6.4)
	// URI of the parent type metadata
	Extends string `json:"extends,omitempty"`

	// ExtendsIntegrity provides integrity protection per section 7
	// Uses Subresource Integrity format (OPTIONAL)
	ExtendsIntegrity string `json:"extends#integrity,omitempty"`
}

type VCTMDisplay struct {
	// Locale is the language tag per RFC 5646 (REQUIRED per section 8)
	// Per draft-12+ this field is named "locale" in JSON (changed from "lang" in earlier drafts)
	Locale string `json:"locale"`

	// Name is a human-readable name for end users (REQUIRED per section 8)
	Name string `json:"name"`

	// Description is a human-readable description for end users (OPTIONAL per section 8)
	Description string `json:"description,omitempty"`

	// Rendering contains rendering methods per section 8.1 (OPTIONAL)
	Rendering *Rendering `json:"rendering,omitempty"`
}

type VCTMJSONPath struct {
	Displayable map[string]string `json:"displayable"`
	AllClaims   []string          `json:"all_claims"`
}

type ValidationError struct {
	Field   string
	Message string
}

type ValidationErrors struct {
	Errors []ValidationError
}

type VerificationOptions struct {
	// RequireKeyBinding: whether KB-JWT must be present
	RequireKeyBinding bool
	// ExpectedNonce: nonce to validate in KB-JWT (required if KB-JWT present)
	ExpectedNonce string
	// ExpectedAudience: audience to validate in KB-JWT (required if KB-JWT present)
	ExpectedAudience string
	// AllowedClockSkew: allowed time skew for exp/iat validation (default: 5 minutes)
	AllowedClockSkew time.Duration
	// ValidateTime: whether to validate exp/iat claims (default: true)
	ValidateTime bool
	// TrustEvaluator: optional trust evaluator for validating issuer's key
	// When set and x5c header is present, the certificate chain will be validated
	// against the trust framework. If not set, the provided public key is used directly.
	TrustEvaluator trust.TrustEvaluator
	// TrustContext: context for trust evaluation (optional, defaults to context.Background())
	TrustContext context.Context
	// CredentialType: credential type for policy routing (e.g., "PID", "mDL")
	// If set, this is passed to the TrustEvaluator for policy-based routing.
	// If not set, it will be extracted from the 'vct' claim if present.
	CredentialType string
	// CryptoExt provides extended algorithm and certificate support
	// (e.g. brainpool curves).
	CryptoExt *cryptoutil.Extensions
}

type VerificationResult struct {
	Valid            bool           // Overall validity
	Header           map[string]any // JWT header
	Claims           map[string]any // All claims (including disclosed)
	DisclosedClaims  map[string]any // Only the selectively disclosed claims
	Disclosures      []Disclosure   // Parsed disclosures
	VCTM             *VCTM          // Verifiable Credential Type Metadata
	KeyBindingValid  bool           // Whether KB-JWT is valid (if present)
	KeyBindingClaims map[string]any // KB-JWT claims (if present)
	Errors           []error        // Any validation errors
}