certificate

type CertificateCustomizer[T object.MultiPhaseObject] interface {
	CustomizeCertificate(o T, base TLSSpec) (TLSSpec, error)
}

type CertificateCustomizerFunc[T object.MultiPhaseObject] func(o T, base TLSSpec) (TLSSpec, error)

type CertificateSubject struct {
	Organizations       []string `json:"organizations,omitempty"`
	OrganizationalUnits []string `json:"organizationalUnits,omitempty"`
	Countries           []string `json:"countries,omitempty"`
	Localities          []string `json:"localities,omitempty"`
	Provinces           []string `json:"provinces,omitempty"`
	StreetAddresses     []string `json:"streetAddresses,omitempty"`
	PostalCodes         []string `json:"postalCodes,omitempty"`
	SerialNumber        string   `json:"serialNumber,omitempty"`
}

type ContentIgnoringBackend interface {
	// IgnoresCertificateContent reports whether TLSSpec content fields
	// (subject, SANs, key algorithm/size, usages, validity) are ignored by
	// this backend.
	IgnoresCertificateContent() bool
}

type LayerSignals struct {
	CARotated       bool        // a CA-saga started this cycle
	LeafRegenerated bool        // leaf regenerated (CA saga OR leaf-only)
	LeafChange      *LeafChange // drift/expiry detail (SAN/IP/node deltas)
	Forced          bool        // a force annotation was honored this cycle
}

type LeafChange struct {
	Reason       LeafChangeReason
	SANsAdded    []string
	SANsRemoved  []string
	IPsAdded     []string
	IPsRemoved   []string
	NodesAdded   []string
	NodesRemoved []string
}

type LeafChangeReason string

type LeafManager[T object.MultiPhaseObject] interface {
	// DesiredLeafWithCA re-issues the leaf signed by the CA in caSecret,
	// reusing that CA's key/cert (no new CA). The returned Secret's ca.crt
	// equals caSecret's ca.crt (single CA, no bundle).
	DesiredLeafWithCA(ctx context.Context, o T, spec TLSSpec, caSecret *corev1.Secret) (*corev1.Secret, error)

	// LeafNeedsChange reports whether the leaf Secret needs regeneration vs
	// spec at now. leafSecret may be nil (treated as LeafMissing).
	LeafNeedsChange(ctx context.Context, o T, leafSecret *corev1.Secret, spec TLSSpec, now time.Time) (LeafChange, error)
}

type NodeSetTLSBackend[T object.MultiPhaseObject] interface {
	TLSBackend[T]
	// ExpectedNodeNames returns the node names that should have a certificate.
	ExpectedNodeNames(o T) ([]string, error)
	// NodeSecretKeys returns the Data-key suffixes for a node's cert and key
	// (e.g. ".crt", ".key"); a node's Data keys are name+certSuffix and
	// name+keySuffix.
	NodeSecretKeys() (certSuffix, keySuffix string)
}

type RolloutPolicy string

type TLSBackend[T object.MultiPhaseObject] interface {
	// DesiredObjects returns the child objects that the reconciler should
	// manage via SSA. These may be Secrets (self-managed) or cert-manager
	// CRs (cert-manager backend).
	DesiredObjects(ctx context.Context, o T, spec TLSSpec) ([]client.Object, error)

	// CertificateSecretName returns the name of the Secret that consumers
	// should mount or hash for rolling restart.
	CertificateSecretName(o T, spec TLSSpec) string

	// RequiresRotationSaga reports whether the multi-cycle CA-rotation
	// workflow is needed. Only the self-managed mutual-TLS backend returns
	// true; cert-manager and BYO backends return false.
	RequiresRotationSaga() bool
}

type TLSSpec struct {
	// SecretName is the name of the Secret that will hold the certificate
	// and key. Consumers mount this Secret or hash it for rollout.
	SecretName string `json:"secretName,omitempty"`

	// IssuerRef references an existing Issuer or ClusterIssuer for the
	// cert-manager backend (existing-CA mode). When empty, a self-signed
	// Issuer is created (dedicated-CA mode).
	IssuerRef string `json:"issuerRef,omitempty"`

	// CommonName is the CN for the generated certificate.
	CommonName string `json:"commonName,omitempty"`

	// DNSNames lists the SAN DNS names for the certificate.
	DNSNames []string `json:"dnsNames,omitempty"`

	// Organization is the O field for the certificate.
	Organization string `json:"organization,omitempty"`

	// LeafValidityDays is the leaf certificate validity in days.
	// Defaults to 365 if not set (see GetValidLeafDays).
	LeafValidityDays int `json:"leafValidityDays,omitempty"`

	// CAValidityDays is the CA certificate validity in days.
	// Defaults to 2× LeafValidityDays when <= 0 (see GetValidCADays).
	CAValidityDays int `json:"caValidityDays,omitempty"`

	// Curve selects the ECDSA curve. One of P-256 (default), P-384, P-521.
	// Unknown values are rejected by ValidateContent. It drives the effective
	// ECDSA key size (EffectiveKeySize) and therefore also cert-manager's
	// privateKey.size.
	Curve string `json:"curve,omitempty"`

	// IPAddresses lists the SAN IPs for the generated certificate.
	// Each entry must parse via net.ParseIP.
	IPAddresses []string `json:"ipAddresses,omitempty"`

	// RenewalDays is the window before expiry during which renewal is
	// triggered. Defaults to 30 (see GetValidRenewalDays).
	RenewalDays int `json:"renewalDays,omitempty"`

	// GenerateCRL, when true, adds a ca.crl key (DER-encoded revocation
	// list) to the CA Secret (selfmanaged only).
	GenerateCRL bool `json:"generateCRL,omitempty"`

	// Subject is the extended RDN block. When Subject.Organizations is empty,
	// the legacy Organization field is used (backward compatible).
	Subject CertificateSubject `json:"subject,omitempty"`

	// KeyAlgorithm is ECDSA (default) or RSA.
	KeyAlgorithm string `json:"keyAlgorithm,omitempty"`

	// KeySize is the key size in bits. 0 = default per algorithm
	// (ECDSA -> 256/P-256; RSA -> 2048). For ECDSA must be 256/384/521.
	KeySize int `json:"keySize,omitempty"`

	// Usages is the leaf ExtKeyUsage list (see Usage* constants).
	// Empty = [serverAuth, clientAuth].
	Usages []string `json:"usages,omitempty"`

	// KeyUsages is the leaf KeyUsage list (see KeyUsage* constants).
	// Empty = [digitalSignature, keyEncipherment].
	KeyUsages []string `json:"keyUsages,omitempty"`

	// CACommonName overrides the CA certificate CN. Default "<CommonName>-ca".
	CACommonName string `json:"caCommonName,omitempty"`

	// CASubject overrides the CA RDN block. Default = leaf subject with
	// CN = CACommonName.
	CASubject *CertificateSubject `json:"caSubject,omitempty"`
}

type TLSSpecProvider[T object.MultiPhaseObject] interface {
	TLSSpec(o T) TLSSpec
}

type TLSSpecProviderFunc[T object.MultiPhaseObject] func(o T) TLSSpec