certproxy

type Config struct {
	// Token is a random value that prefixes the proxy's control paths.
	Token string `json:"token"`
	// CDPURL is the DevTools address of the browser the proxy serves, such
	// as http://127.0.0.1:9333.
	CDPURL string `json:"cdp_url"`
	// SystemPAC is a PAC script for the device's own routing. Empty routes
	// everything directly.
	SystemPAC string `json:"system_pac"`
	// Entries are the certificates; the first whose hosts match a host is
	// presented to it.
	Entries []Entry `json:"entries"`
	// TrustedCAs add server trust to the hosts each names. Every matching
	// authority applies, beside the entry presented there, if any.
	TrustedCAs []TrustedCA `json:"trusted_cas,omitempty"`
	// GraceSeconds is how long the proxy waits for the browser to answer
	// for the first time; zero means five minutes.
	GraceSeconds int `json:"grace_seconds,omitempty"`
	// Guard sends the browser's other https: requests through the proxy too,
	// so the browser never answers a site's request for a client
	// certificate itself; a host no entry names gets none.
	Guard bool `json:"guard,omitempty"`
}

type Entry struct {
	// Label names the entry in messages, such as
	// with.browser.client_certificates[0].
	Label string `json:"label"`
	// Hosts are host patterns, as the hostpattern package matches them.
	Hosts []string `json:"hosts"`
	// ChainPEM holds the certificate, then its intermediates.
	ChainPEM string `json:"chain_pem"`
	// KeyPEM holds the certificate's private key as PKCS#8.
	KeyPEM string `json:"key_pem"`
	// CAPEM holds certificates trusted, beside the system's, for the hosts'
	// servers.
	CAPEM string `json:"ca_pem,omitempty"`
}

type Event struct {
	Seq  int64     `json:"seq"`
	Time time.Time `json:"time"`
	Kind string    `json:"kind"`
	Host string    `json:"host"`
	// Entry is the label of the entry involved, if any.
	Entry string `json:"entry,omitempty"`
	// Message explains the event in a sentence of its own.
	Message string `json:"message,omitempty"`
	// Presented is set on a connection on which the entry's certificate
	// was presented.
	Presented bool `json:"presented,omitempty"`
}

type Handle struct {
	// URL is the base of the proxy's control paths.
	URL string `json:"url"`
	PID int    `json:"pid"`
	// StartedAt is the process's start time in Unix milliseconds, which
	// tells it apart from a later process reusing PID.
	StartedAt int64  `json:"started_at"`
	PACURL    string `json:"pac_url"`
	SPKI      string `json:"spki"`
}

type Pending struct {
	Host  string    `json:"host"`
	Phase string    `json:"phase"`
	Since time.Time `json:"since"`
}

type Ready struct {
	Port int `json:"port"`
	// SPKI is the base64 SHA-256 hash of the public key of every
	// certificate the proxy shows the browser, in the form Chrome's
	// --ignore-certificate-errors-spki-list takes.
	SPKI string `json:"spki"`
	// PACURL is the PAC script the browser uses: a data: URL, or one the
	// proxy serves when the script is too large for a command line.
	PACURL string `json:"pac_url"`
	// GuardPort is the port of the guard, or zero without one.
	GuardPort int `json:"guard_port,omitempty"`
}

type TrustedCA struct {
	// Label names the authority in messages, such as browser.trusted_cas[0].
	Label string `json:"label"`
	// Hosts are host patterns, as the hostpattern package matches them.
	Hosts []string `json:"hosts"`
	// CAPEM holds the authority's certificates.
	CAPEM string `json:"ca_pem"`
}