certificate

type CertChainEntry struct {
	ID            string    `json:"id"`
	CheckResultID string    `json:"check_result_id"`
	Position      int       `json:"position"`
	SubjectCN     string    `json:"subject_cn"`
	IssuerCN      string    `json:"issuer_cn"`
	NotBefore     time.Time `json:"not_before"`
	NotAfter      time.Time `json:"not_after"`
}

type CertCheckResult struct {
	ID                 string     `json:"id"`
	MonitorID          string     `json:"monitor_id"`
	SubjectCN          string     `json:"subject_cn,omitempty"`
	IssuerCN           string     `json:"issuer_cn,omitempty"`
	IssuerOrg          string     `json:"issuer_org,omitempty"`
	SANs               []string   `json:"sans,omitempty"`
	SerialNumber       string     `json:"serial_number,omitempty"`
	SignatureAlgorithm string     `json:"signature_algorithm,omitempty"`
	NotBefore          *time.Time `json:"not_before,omitempty"`
	NotAfter           *time.Time `json:"not_after,omitempty"`
	ChainValid         *bool      `json:"chain_valid,omitempty"`
	ChainError         string     `json:"chain_error,omitempty"`
	HostnameMatch      *bool      `json:"hostname_match,omitempty"`
	ErrorMessage       string     `json:"error_message,omitempty"`
	CheckedAt          time.Time  `json:"checked_at"`
	OCSPStapled        bool       `json:"ocsp_stapled,omitempty"`
	OCSPStatus         string     `json:"ocsp_status,omitempty"`
	OCSPProducedAt     *time.Time `json:"ocsp_produced_at,omitempty"`
	OCSPNextUpdate     *time.Time `json:"ocsp_next_update,omitempty"`
	OCSPError          string     `json:"ocsp_error,omitempty"`
}

type CertMonitor struct {
	ID       string `json:"id"`
	Hostname string `json:"hostname"`
	Port     int    `json:"port"`
	// ServerName, when non-empty, is sent as SNI during the check and the
	// certificate is validated against it instead of Hostname.
	ServerName           string     `json:"server_name,omitempty"`
	Source               CertSource `json:"source"`
	EndpointID           *string    `json:"endpoint_id,omitempty"`
	Status               CertStatus `json:"status"`
	CheckIntervalSeconds int        `json:"check_interval_seconds"`
	WarningThresholds    []int      `json:"warning_thresholds"`
	LastAlertedThreshold *int       `json:"last_alerted_threshold,omitempty"`
	LastCheckAt          *time.Time `json:"last_check_at,omitempty"`
	NextCheckAt          *time.Time `json:"next_check_at,omitempty"`
	LastError            string     `json:"last_error,omitempty"`
	ExternalID           string     `json:"external_id,omitempty"`
	CreatedAt            time.Time  `json:"created_at"`
	AgentID              string     `json:"agent_id"`
}

type CertSource string

type CertStatus string

type CertificateStore interface {
	// Monitor CRUD
	CreateMonitor(ctx context.Context, m *CertMonitor) (string, error)
	GetMonitorByID(ctx context.Context, id string) (*CertMonitor, error)
	GetMonitorByHostPort(ctx context.Context, hostname string, port int, serverName string) (*CertMonitor, error)
	GetMonitorByHostPortAgent(ctx context.Context, agentID *string, hostname string, port int, serverName string) (*CertMonitor, error)
	GetMonitorByEndpointID(ctx context.Context, endpointID string) (*CertMonitor, error)
	ListMonitors(ctx context.Context, opts ListCertificatesOpts) ([]*CertMonitor, error)
	CountStandaloneMonitors(ctx context.Context) (int, error)
	UpdateMonitor(ctx context.Context, m *CertMonitor) error
	DeleteMonitor(ctx context.Context, id string) error

	// Check results
	InsertCheckResult(ctx context.Context, result *CertCheckResult) (string, error)
	GetLatestCheckResult(ctx context.Context, monitorID string) (*CertCheckResult, error)
	ListCheckResults(ctx context.Context, monitorID string, opts ListChecksOpts) ([]*CertCheckResult, int, error)

	// Chain entries
	InsertChainEntries(ctx context.Context, entries []*CertChainEntry) error
	GetChainEntries(ctx context.Context, checkResultID string) ([]*CertChainEntry, error)

	// Label-discovered monitors
	ListMonitorsByExternalID(ctx context.Context, externalID string) ([]*CertMonitor, error)

	// Scheduler
	ListDueScheduledMonitors(ctx context.Context, now time.Time) ([]*CertMonitor, error)

	// Retention
	DeleteCheckResultsBefore(ctx context.Context, before time.Time, batchSize int) (int64, error)
}

type ChainCert struct {
	SubjectCN string
	IssuerCN  string
	NotBefore time.Time
	NotAfter  time.Time
}

type CheckCertificateResult struct {
	SubjectCN          string
	IssuerCN           string
	IssuerOrg          string
	SANs               []string
	SerialNumber       string
	SignatureAlgorithm string
	NotBefore          time.Time
	NotAfter           time.Time
	ChainValid         bool
	ChainError         string
	HostnameMatch      bool
	Chain              []ChainCert
	Error              string

	OCSPStapled    bool
	OCSPStatus     string
	OCSPProducedAt *time.Time
	OCSPNextUpdate *time.Time
	OCSPError      string
}

type CreateCertificateInput struct {
	Hostname             string `json:"hostname"`
	Port                 int    `json:"port"`
	ServerName           string `json:"server_name"`
	CheckIntervalSeconds int    `json:"check_interval_seconds"`
	WarningThresholds    []int  `json:"warning_thresholds"`
}

type DefaultLicenseChecker struct {
	MaxCertificates int
}

type Deps struct {
	Store          CertificateStore // required
	Logger         *slog.Logger     // required
	LicenseChecker LicenseChecker   // optional — defaults to community limits
	EventCallback  EventCallback    // optional — nil-safe
}

type EventCallback func(eventType string, data interface{})

type LicenseChecker interface {
	CanCreateCertificate(currentCount int) bool
}

type ListCertificatesOpts struct {
	Status string
	Source string
	// AgentFilter filters by agent_id. Nil = no filter; "local" = agent_id IS NULL; UUID = specific agent.
	AgentFilter *string
}

type ListChecksOpts struct {
	Limit  int
	Offset int
}

type ParsedCertLabel struct {
	Hostname string
	Port     int
}

type Service struct {
	// contains filtered or unexported fields
}

type UpdateCertificateInput struct {
	CheckIntervalSeconds *int  `json:"check_interval_seconds,omitempty"`
	WarningThresholds    []int `json:"warning_thresholds,omitempty"`
}