kmstypes

type AsymmetricDecryptRequest struct {
	KeyID            string `json:"keyID,omitempty"`
	CiphertextBase64 []byte `json:"ciphertextBase64,omitempty"`
}

type AsymmetricDecryptResponse struct {
	PlaintextBase64 []byte `json:"plaintextBase64,omitempty"`
}

type AsymmetricPlugin interface {
	GetPublicKey(ctx context.Context, req *GetPublicKeyRequest) (*PublicKey, error)
	// AsymmetricDecrypt decrypts data that was encrypted with a public key retrieved from GetPublicKey
	// corresponding to a CryptoKeyVersion with CryptoKey.purpose ASYMMETRIC_DECRYPT.
	AsymmetricDecrypt(ctx context.Context, req *AsymmetricDecryptRequest) (*AsymmetricDecryptResponse, error)
}

type BasePlugin interface {
	// CreateKey create symmetric or asymmetric CMK
	CreateKey(ctx context.Context, req *CreateKeyRequest) (*CreateKeyResponse, error)
	DescribeKey(ctx context.Context, req *DescribeKeyRequest) (*DescribeKeyResponse, error)
	ListKeys(ctx context.Context, req *ListKeysRequest) (*ListKeysResponse, error)
}

type CreateKeyRequest struct {
	PluginKind            PluginKind            `json:"pluginKind,omitempty"`
	CustomerMasterKeySpec CustomerMasterKeySpec `json:"customerMasterKeySpec,omitempty"`
	KeyUsage              KeyUsage              `json:"keyUsage,omitempty"`
	Description           string                `json:"description,omitempty"`
}

type CreateKeyResponse struct {
	KeyMetadata KeyMetadata `json:"keyMetadata,omitempty"`
}

type CustomerMasterKeySpec string

type DecryptRequest struct {
	KeyID string `json:"keyID,omitempty"`
	// The encrypted data.
	// A base64-encoded string.
	CiphertextBase64 string `json:"ciphertextBase64,omitempty"`
}

type DecryptResponse struct {
	PlaintextBase64 string `json:"plaintextBase64,omitempty"`
}

type DescribeKeyRequest struct {
	KeyID string `json:"keyID,omitempty"`
}

type DescribeKeyResponse struct {
	KeyMetadata KeyMetadata `json:"keyMetadata,omitempty"`
}

type EncryptRequest struct {
	KeyID string `json:"keyID,omitempty"`
	// Required. The data to encrypt. Must be no larger than 64KiB.
	// A base64-encoded string.
	PlaintextBase64 string `json:"plaintextBase64,omitempty"`
}

type EncryptResponse struct {
	KeyID string `json:"keyID,omitempty"`
	// The encrypted data.
	// A base64-encoded string.
	CiphertextBase64 string `json:"ciphertextBase64,omitempty"`
}

type GenerateDataKeyRequest struct {
	KeyID string `json:"keyID,omitempty"`
}

type GenerateDataKeyResponse struct {
	KeyID            string `json:"keyID,omitempty"`
	KeyVersionID     string `json:"keyVersionID,omitempty"`
	CiphertextBase64 string `json:"ciphertextBase64,omitempty"`
	PlaintextBase64  string `json:"plaintextBase64,omitempty"`
}

type GetPublicKeyRequest struct {
	KeyID string `json:"keyID,omitempty"`
}

type Key struct {
	PluginKind        PluginKind            `json:"pluginKind,omitempty"`
	KeyID             string                `json:"keyID,omitempty"`
	PrimaryKeyVersion KeyVersion            `json:"primaryKeyVersion,omitempty"`
	KeySpec           CustomerMasterKeySpec `json:"keySpec,omitempty"`
	KeyUsage          KeyUsage              `json:"keyUsage,omitempty"`
	KeyState          KeyState              `json:"keyState,omitempty"`
	Description       string                `json:"description,omitempty"`
	CreatedAt         *time.Time            `json:"createdAt,omitempty"`
	UpdatedAt         *time.Time            `json:"updatedAt,omitempty"`
}

type KeyInfo interface {
	New() KeyInfo

	GetPluginKind() PluginKind
	SetPluginKind(PluginKind)

	GetKeyID() string
	SetKeyID(string)

	GetPrimaryKeyVersion() KeyVersionInfo
	SetPrimaryKeyVersion(KeyVersionInfo)

	GetKeySpec() CustomerMasterKeySpec
	SetKeySpec(CustomerMasterKeySpec)
	GetKeyUsage() KeyUsage
	SetKeyUsage(KeyUsage)
	GetKeyState() KeyState
	SetKeyState(KeyState)

	GetDescription() string
	SetDescription(string)

	GetCreatedAt() *time.Time
	SetCreatedAt(time.Time)
	GetUpdatedAt() *time.Time
	SetUpdatedAt(time.Time)
}

type KeyListEntry struct {
	KeyID string `json:"keyID,omitempty"`
}

type KeyMetadata struct {
	KeyID                 string                `json:"keyID,omitempty"`
	PrimaryKeyVersionID   string                `json:"primaryKeyVersionID,omitempty"`
	CustomerMasterKeySpec CustomerMasterKeySpec `json:"customerMasterKeySpec,omitempty"`
	KeyUsage              KeyUsage              `json:"keyUsage,omitempty"`
	KeyState              KeyState              `json:"keyState,omitempty"`
	Description           string                `json:"description,omitempty"`
}

type KeyState string

type KeyUsage string

type KeyVersion struct {
	VersionID string `json:"versionID,omitempty"`
	// base64 encoded
	SymmetricKeyBase64 string     `json:"symmetricKeyBase64,omitempty"`
	CreatedAt          *time.Time `json:"createdAt,omitempty"`
	UpdatedAt          *time.Time `json:"updatedAt,omitempty"`
}

type KeyVersionInfo interface {
	New() KeyVersionInfo

	GetVersionID() string
	SetVersionID(string)

	GetSymmetricKeyBase64() string
	SetSymmetricKeyBase64(string)

	GetCreatedAt() *time.Time
	SetCreatedAt(time.Time)

	GetUpdatedAt() *time.Time
	SetUpdatedAt(time.Time)
}

type ListKeysRequest struct {
}

type ListKeysResponse struct {
	Keys []KeyListEntry `json:"keys,omitempty"`
}

type Plugin interface {
	Kind() PluginKind
	SetStore(Store)
	BasePlugin
	SymmetricPlugin
	AsymmetricPlugin
}

type PluginCreateFn func(ctx context.Context) Plugin

type PluginKind string

type PublicKey struct {
	Pem       string `json:"pem,omitempty"`
	Algorithm string `json:"algorithm,omitempty"`
}

type RequestValidator interface {
	ValidateRequest() error
}

type RotateKeyVersionRequest struct {
	KeyID string `json:"keyID,omitempty"`
}

type RotateKeyVersionResponse struct {
	KeyMetadata KeyMetadata `json:"keyMetadata,omitempty"`
}

type Store interface {
	// PluginKind is key store type
	GetKind() StoreKind

	// Create create and store new CMK
	CreateKey(info KeyInfo) error

	// GetKey use keyID to find CMK
	GetKey(keyID string) (KeyInfo, error)

	// ListByKind use plugin type to list CMKs
	ListKeysByKind(kind PluginKind) ([]string, error)

	// DeleteByKeyID use keyID to delete CMK
	DeleteByKeyID(keyID string) error

	// GetKeyVersion use keyID and keyVersionID to find keyVersion
	GetKeyVersion(keyID, keyVersionID string) (KeyVersionInfo, error)

	// RotateKeyVersion rotate key version
	RotateKeyVersion(keyID string, newKeyVersionInfo KeyVersionInfo) (KeyVersionInfo, error)
}

type StoreCreateFn func(ctx context.Context) Store

type StoreKind string

type SymmetricPlugin interface {
	Encrypt(ctx context.Context, req *EncryptRequest) (*EncryptResponse, error)
	Decrypt(ctx context.Context, req *DecryptRequest) (*DecryptResponse, error)
	// GenerateDataKey generate AES 256 DEK, encrypted by CMK
	// 典型使用场景（信封加密）：
	// 在本地进行数据加密：
	// 1. 调用 GenerateDataKey 获取 DEK（数据加密密钥）
	// 2. 使用 DEK 的明文，在本地完成离线数据加密，随后清除内存中的 DEK 明文
	// 3. 将 DEK 的密文，和本地离线加密后的数据一并进行存储
	// 在本地进行数据解密：
	// 1. 调用 Decrypt 解密本地存储的 DEK 密文，获取 DEK 明文
	// 2. 使用 DEK 明文，在本地完成离线数据解密，随后清除内存中的 DEK 明文
	GenerateDataKey(ctx context.Context, req *GenerateDataKeyRequest) (*GenerateDataKeyResponse, error)
	// RotateKeyVersion rotate key version for CMK manually, old key version still can be used to decrypt old data
	RotateKeyVersion(ctx context.Context, req *RotateKeyVersionRequest) (*RotateKeyVersionResponse, error)
}