enroll

type ACME struct {
	// DirectoryURL is the ACME directory, which must use https.
	DirectoryURL string
	// ClientIdentifier is what the device orders with, as the
	// permanent-identifier. Apple treats it as an anti-replay code, so it
	// should be unguessable and issued for one device.
	ClientIdentifier string
	// KeyType is KeyTypeEC or KeyTypeRSA, and KeySize is the curve size or
	// the modulus size. Apple requires both.
	KeyType string
	KeySize int64
	// HardwareBound generates the key in the Secure Enclave, where it
	// cannot be exported. Required for Attest.
	HardwareBound bool
	// Attest asks the device for an attestation of the key and of the
	// hardware, which the ACME server verifies. Requires HardwareBound.
	Attest bool
	// Subject, SubjectAltName, UsageFlags and ExtendedKeyUsage express the device's
	// requested certificate properties. Apple permits the server to override them;
	// the reference server selects the subject.
	Subject          pkix.Name
	SubjectAltName   *profiles.ACMECertificateSubjectAltName
	UsageFlags       *int64
	ExtendedKeyUsage []string
	// KeyIsExtractable and AllowAllAppsAccess are macOS only.
	KeyIsExtractable   *bool
	AllowAllAppsAccess *bool
}

type AccessRights int64

type DeviceAttributes struct {
	UDID, Version, Product, Serial, IMEI, MEID, ICCID string
	Challenge                                         string
	// Raw keeps every key received.
	Raw map[string]any
}

type OTAProfile struct {
	Identifier   string
	DisplayName  string
	Organization string
	Description  string
	UUID         string
	PayloadUUID  string
	// URL the device POSTs its attributes to.
	URL string
	// Challenge is echoed back by the device in phase 1.
	Challenge        string
	DeviceAttributes []string
}

type OTARequest struct {
	Phase      Phase
	Attributes DeviceAttributes
	Signer     *x509.Certificate
}

type OTAService struct {
	// DeviceRoots verify phase 1 (the Apple iPhone Device CA chain).
	DeviceRoots *x509.CertPool
	// IdentityRoots verify phase 2 (the CA behind the SCEP endpoint).
	IdentityRoots *x509.CertPool
	// ClockSkew for signing-time checks; default 5 minutes.
	ClockSkew time.Duration
	// Now for verification; default time.Now.
	Now func() time.Time
	// Authorize vets a verified request: challenge, allow-lists. Nil allows.
	Authorize func(ctx context.Context, r *OTARequest) error
	// Profile returns the profile bytes for the phase: the SCEP-bearing
	// profile for phase 1, the MDM enrollment profile for phase 2.
	Profile func(ctx context.Context, r *OTARequest) ([]byte, error)
	// Logger defaults to slog.Default.
	Logger *slog.Logger
	// MaxBytes bounds the request body; default 64 KiB.
	MaxBytes int64
}

type PKCS12 struct {
	Data     []byte
	Password string
	FileName string
}

type Phase int

type Profile struct {
	Identifier   string // top-level PayloadIdentifier, e.g. com.example.mdm
	DisplayName  string
	Description  string
	Organization string

	Topic      string
	ServerURL  string
	CheckInURL string

	// Exactly one identity source.
	SCEP   *SCEP
	ACME   *ACME
	PKCS12 *PKCS12

	// Roots are installed as com.apple.security.root payloads so the device
	// trusts the MDM server and SCEP CA.
	Roots []*x509.Certificate

	AccessRights       AccessRights // default AccessRightsAll
	ServerCapabilities []string
	// SharedIPad marks a profile for Shared iPad (DEP is_multi_user):
	// Apple requires com.apple.mdm.per-user-connections in
	// ServerCapabilities, which Build adds when absent (decision record 0029).
	SharedIPad          bool
	SignMessage         *bool // default true
	CheckOutWhenRemoved bool
	UseDevelopmentAPNS  bool

	// Account-driven and user-enrollment keys.
	AssignedManagedAppleID string
	EnrollmentMode         string

	// UUIDs make the profile stable across rebuilds; empty values are
	// generated and reported back through Built.
	UUID         string
	MDMUUID      string
	IdentityUUID string
	RootUUIDs    []string

	// Target for schema validation; the zero value skips OS checks.
	Target support.Target
}

type SCEP struct {
	KeyIsExtractable   *bool
	AllowAllAppsAccess *bool
	URL                string
	Name               string
	Challenge          string
	Subject            pkix.Name
	// KeySize default 2048; KeyUsage default 5 (signing and encryption).
	KeySize       int64
	KeyUsage      int64
	CAFingerprint []byte
	Retries       int64
	RetryDelay    int64
}