enroll

type Credential struct {
	CertificatePEM []byte
	BundlePEM      []byte
	Serial         string
	ExpiresAt      time.Time
	// LateBy is how long the credential a renewal replaced had been
	// expired; zero for an enrollment and for a renewal on time.
	LateBy time.Duration
}

type Label struct {
	Key   string
	Value string
}

type LateRenewal struct {
	RenewedAt time.Time
	ExpiredAt time.Time
}

type Result struct {
	Workload   Workload
	Credential Credential
}

type Service struct {
	Store     Store
	Authority ca.Authority
	// LeafTTL is the lifetime of issued credentials; DefaultLeafTTL if zero.
	LeafTTL time.Duration
	// RenewalGrace is how long after its expiry a credential may still
	// renew, and do nothing else; DefaultRenewalGrace if zero.
	RenewalGrace time.Duration
	// Now is the clock; time.Now if nil.
	Now func() time.Time
}

type Standing int

type Store interface {
	// CreateToken persists a minted token (hash only).
	CreateToken(ctx context.Context, t Token) error
	// FindTokenByHash returns ErrTokenUnknown when no token has that hash.
	FindTokenByHash(ctx context.Context, hash []byte) (*Token, error)
	// ListTokens returns every token, newest first.
	ListTokens(ctx context.Context) ([]Token, error)
	// RevokeToken marks a token revoked at instant now. It returns
	// ErrTokenUnknown for an unknown id and ErrTokenRevoked if it already was.
	RevokeToken(ctx context.Context, id uuid.UUID, now time.Time) error

	// CreateWorkload persists a newly enrolled workload with its labels and
	// records the use against its token, atomically.
	CreateWorkload(ctx context.Context, w Workload, now time.Time) error
	// GetWorkload returns ErrWorkloadUnknown when the id is not registered.
	GetWorkload(ctx context.Context, id identity.WorkloadID) (*Workload, error)
	// RecordRenewal stores the serial and expiry of a renewed credential,
	// and, when late is non-nil, records it as the workload's latest late
	// renewal in the same write. It returns ErrWorkloadUnknown when the id
	// is not registered and a *registry.RetiredError when the workload was
	// retired, however recently: the write is conditioned on it.
	RecordRenewal(ctx context.Context, id identity.WorkloadID, serial string, expiresAt, now time.Time, late *LateRenewal) error
}

type Token struct {
	ID         uuid.UUID
	Hash       []byte
	Prefix     *string
	Name       string
	Labels     []Label
	CreatedAt  time.Time
	ExpiresAt  time.Time
	RevokedAt  *time.Time
	UseCount   int64
	LastUsedAt *time.Time
}

type Workload struct {
	ID                  identity.WorkloadID
	TokenID             uuid.UUID
	Hostname            string
	Labels              []Label
	EnrolledAt          time.Time
	CredentialSerial    string
	CredentialExpiresAt time.Time
	LastRenewedAt       *time.Time
	// LateRenewal is the latest renewal made with an already-expired
	// credential, within the grace; nil when there has been none.
	LateRenewal *LateRenewal
	// RetiredAt is when the operator retired the workload; nil while it
	// is active. A retired identity renews nothing (ADR-0023).
	RetiredAt *time.Time
}