certmanager

type BundleOption func(*bundle) error

type BundleProvider interface {
	// Name returns the unique, stable identifier of the bundle.
	Name() string

	// Configs returns the configuration sources that belong to this bundle.
	Configs() map[string]ConfigProvider

	// Provisioners returns the provisioner factories allowed for this bundle,
	// keyed by provisioner type.
	Provisioners() map[string]ProvisionerFactory

	// Storages returns the storage factories allowed for this bundle,
	// keyed by storage type.
	Storages() map[string]StorageFactory

	// DisableRenewal disables time-based renewal for all certificates produced by
	// config providers in this bundle.
	DisableRenewal() bool
}

type CertManager struct {
	// contains filtered or unexported fields
}

type CertificateConfig struct {
	// Unique certificate identifier
	Name string `json:"name"`
	// Provisioner configuration
	Provisioner ProvisionerConfig `json:"provisioner"`
	// Storage configuration
	Storage StorageConfig `json:"storage"`
	// RenewBefore controls how long before NotAfter we should renew
	//
	// If set and valid (0 < RenewBefore < cert lifetime), it takes precedence over RenewBeforePercentage.
	// If invalid, it is ignored and RenewBeforePercentage (if valid) may be used.
	RenewBefore *time.Duration `json:"renewBefore,omitempty"`
	// RenewBeforePercentage controls how far through the certificate lifetime we renew, expressed
	// as a percentage of the lifetime. Valid range: (0,100)
	//
	// Example: 50 means renew when 50% of the lifetime remains (i.e., halfway through lifetime).
	// If RenewBefore is set and valid, RenewBeforePercentage is ignored.
	RenewBeforePercentage *int32 `json:"renewBeforePercentage,omitempty"`
}

type CertificateInfo struct {
	// Certificate validity start time
	NotBefore *time.Time `json:"not_before,omitempty"`
	// Certificate validity end time (expiration)
	NotAfter *time.Time `json:"not_after,omitempty"`
}

type CertificateReconciler struct {
	// contains filtered or unexported fields
}

type ConfigProvider interface {
	// Name returns a unique identifier for this configuration provider
	Name() string
	// GetCertificateConfigs returns all certificate configurations from this provider
	GetCertificateConfigs() ([]CertificateConfig, error)
}

type HandlerFunc[T any] func(ctx context.Context, item T, attempt int) *time.Duration

type Logger interface {
	Info(args ...any)
	Warn(args ...any)
	Error(args ...any)
	Debug(args ...any)
	Infof(format string, args ...any)
	Warnf(format string, args ...any)
	Errorf(format string, args ...any)
	Debugf(format string, args ...any)
}

type ManagerOption func(*CertManager) error

type ProvisionRequest struct {
	Desired     CertificateConfig
	LastApplied CertificateConfig

	// Attempt is the 1-based attempt number for the current provisioning cycle.
	// The manager increments this when retrying after Ready == false or transient errors.
	Attempt int
}

type ProvisionResult struct {
	// Ready indicates whether the certificate is fully provisioned.
	// If false, the caller should retry after RequeueAfter.
	Ready bool

	// Cert contains the provisioned X.509 certificate in PEM form.
	//
	// MUST be non-nil when Ready == true.
	// MUST be nil when Ready == false.
	Cert []byte

	// Key contains the private key material in PEM form, if exportable.
	//
	// Key MAY be nil even when Ready == true, to support non-exportable keys
	// (e.g. TPM-backed or HSM-backed keys).
	//
	// Storage providers MUST tolerate Key == nil.
	Key []byte

	// RequeueAfter specifies how long to wait before retrying provisioning
	// when Ready == false.
	//
	// If <= 0, the manager will apply DefaultRequeueDelay.
	RequeueAfter time.Duration

	// Meta carries optional, opaque data produced by the provisioner.
	//
	// This is intended for provisioner-to-storage handoff or other internal coordination.
	// Keys SHOULD be namespaced to avoid collisions.
	//
	// Values are opaque bytes and must be interpreted only by components that
	// explicitly understand them.
	//
	// Meta SHOULD be ignored when Ready == false.
	Meta map[string][]byte
}

type ProvisionerConfig struct {
	// Provisioner type identifier (e.g., "csr", "self-signed")
	Type ProvisionerType `json:"type,omitempty"`
	// Type-specific configuration as JSON
	Config json.RawMessage `json:"config,omitempty"`
}

type ProvisionerFactory interface {
	// Type returns the provisioner type identifier (e.g., "csr", "self-signed")
	Type() string
	// New creates a new provisioner instance from the certificate configuration
	New(log Logger, cc CertificateConfig) (ProvisionerProvider, error)
	// Validate checks if the certificate configuration is valid for this provisioner type
	Validate(log Logger, cc CertificateConfig) error
}

type ProvisionerProvider interface {
	// Provision performs a single provisioning step.
	//
	// It MUST be safe to call multiple times.
	//
	// Contract:
	//   - If result.Ready == true:
	//       - result.Cert MUST be non-nil
	//       - result.Key MAY be nil (non-exportable key)
	//       - result.RequeueAfter is ignored
	//   - If result.Ready == false:
	//       - result.RequeueAfter controls retry timing (<=0 means "use manager default")
	//       - result.Cert, result.Key, and result.Meta are ignored.
	//
	// Returning a non-nil error indicates a hard failure and aborts the current provisioning attempt.
	// If err == nil, result MUST be non-nil.
	Provision(ctx context.Context, req ProvisionRequest) (*ProvisionResult, error)
}

type ProvisionerType string

type RetryQueue[T any] struct {
	// contains filtered or unexported fields
}

type StorageConfig struct {
	// Storage type identifier (e.g., "filesystem")
	Type StorageType `json:"type,omitempty"`
	// Type-specific configuration as JSON
	Config json.RawMessage `json:"config,omitempty"`
}

type StorageFactory interface {
	// Type returns the storage type identifier (e.g., "filesystem", "empty")
	Type() string
	// New creates a new storage instance from the certificate configuration
	New(log Logger, cc CertificateConfig) (StorageProvider, error)
	// Validate checks if the certificate configuration is valid for this storage type
	Validate(log Logger, cc CertificateConfig) error
}

type StorageProvider interface {
	// Store persists provisioned material according to the desired configuration.
	//
	// The storage implementation MUST:
	//   - Persist req.Result.Cert.
	//   - Persist req.Result.Key if applicable for this storage backend.
	//
	// The storage implementation MAY:
	//   - Use req.LastApplied to perform best-effort cleanup or migration.
	//
	// If req.LastApplied.IsEmpty(), the previous state MUST be treated as unknown
	// and no cleanup or migration should be attempted.
	Store(ctx context.Context, req StoreRequest) error

	// LoadCertificate loads an existing certificate if present.
	//
	// Returning (nil, nil) indicates that no certificate is currently stored.
	LoadCertificate(ctx context.Context) (*x509.Certificate, error)
}

type StorageType string

type StoreRequest struct {
	Result      *ProvisionResult
	Desired     StorageConfig
	LastApplied StorageConfig
}