access

type AdditionalRewrapContext struct {
	Obligations ObligationCtx `json:"obligations"`
}

type Attribute struct {
	URI           string           `json:"attribute"` // attribute
	PublicKey     crypto.PublicKey `json:"pubKey"`    // pubKey
	ProviderURI   string           `json:"kasUrl"`    // kasUrl
	SchemaVersion string           `json:"tdf_spec_version,omitempty"`
	Name          string           `json:"displayName"` // displayName
}

type CurrentKeyFor struct {
	Algorithm string `mapstructure:"alg" json:"alg"`
	KID       string `mapstructure:"kid" json:"kid"`
	// Indicates that the key should not be serves by default,
	// but instead is allowed for legacy reasons on decrypt (rewrap) only
	Legacy bool `mapstructure:"legacy" json:"legacy"`
}

type Error string

type KASConfig struct {
	// Which keys are currently the default.
	Keyring []CurrentKeyFor `mapstructure:"keyring" json:"keyring"`
	// Deprecated
	ECCertID string `mapstructure:"eccertid" json:"eccertid"`
	// Deprecated
	RSACertID string `mapstructure:"rsacertid" json:"rsacertid"`

	RootKey string `mapstructure:"root_key" json:"root_key"`

	KeyCacheExpiration time.Duration `mapstructure:"key_cache_expiration" json:"key_cache_expiration"`

	// Deprecated
	// Moved to Preview
	ECTDFEnabled bool `mapstructure:"ec_tdf_enabled" json:"ec_tdf_enabled"`
	// Deprecated
	// Moved to Preview
	HybridTDFEnabled bool `mapstructure:"hybrid_tdf_enabled" json:"hybrid_tdf_enabled"`

	Preview          Preview `mapstructure:"preview" json:"preview"`
	RegisteredKASURI string  `mapstructure:"registered_kas_uri" json:"registered_kas_uri"`
}

type KeyAccess struct {
	EncryptedMetadata  string      `json:"encryptedMetadata,omitempty"`
	PolicyBinding      interface{} `json:"policyBinding,omitempty"`
	Protocol           string      `json:"protocol"`
	Type               string      `json:"type"`
	URL                string      `json:"url"`
	KID                string      `json:"kid,omitempty"`
	SID                string      `json:"sid,omitempty"`
	WrappedKey         []byte      `json:"wrappedKey,omitempty"`
	Header             []byte      `json:"header,omitempty"`
	Algorithm          string      `json:"algorithm,omitempty"`
	EphemeralPublicKey string      `json:"ephemeralPublicKey,omitempty"`
}

type ObligationCtx struct {
	FulfillableFQNs []string `json:"fulfillableFQNs,omitempty"`
}

type PDPAccessResult struct {
	Access              bool
	Error               error
	Policy              *Policy
	RequiredObligations []string
}

type Policy struct {
	UUID uuid.UUID  `json:"uuid"`
	Body PolicyBody `json:"body"`
}

type PolicyBody struct {
	DataAttributes []Attribute `json:"dataAttributes"`
	Dissem         []string    `json:"dissem"`
}

type Preview struct {
	ECTDFEnabled bool `mapstructure:"ec_tdf_enabled" json:"ec_tdf_enabled"`
	// HybridTDFEnabled is a preview feature that enables support for hybrid rewrap in TDFs.
	// Enabling is required to parse KAOs with the `hybrid-wrapped` type,
	// and (currently) also enables responding with hybrid encrypted responses.
	// This feature is experimental and may be removed or changed in future releases.
	// Enabling this also enables ML-KEM rewrap support; it cannot be enabled
	// while ML-KEM is disabled (see normalizePreview).
	HybridTDFEnabled bool `mapstructure:"hybrid_tdf_enabled" json:"hybrid_tdf_enabled"`
	// MLKEMTDFEnabled is a preview feature that enables support for ML-KEM rewrap in TDFs.
	// Enabling is required to parse KAOs with the `mlkem-wrapped` type,
	// and (currently) also enables responding with ML-KEM encrypted responses.
	// This feature is experimental and may be removed or changed in future releases.
	MLKEMTDFEnabled bool `mapstructure:"mlkem_tdf_enabled" json:"mlkem_tdf_enabled"`
	KeyManagement   bool `mapstructure:"key_management" json:"key_management"`
}

type Provider struct {
	kaspb.AccessServiceServer
	SDK          *otdf.SDK
	AttributeSvc *url.URL
	KeyDelegator *trust.DelegatingKeyService
	// Deprecated: Use SecurityProvider instead
	CryptoProvider *security.StandardCrypto // Kept for backward compatibility
	Logger         *logger.Logger
	Config         *config.ServiceConfig
	KASConfig

	trace.Tracer
	// contains filtered or unexported fields
}

type RequestBody struct {
	AuthToken       string      `json:"authToken"`
	KeyAccess       KeyAccess   `json:"keyAccess"`
	Policy          string      `json:"policy,omitempty"`
	Algorithm       string      `json:"algorithm,omitempty"`
	ClientPublicKey string      `json:"clientPublicKey"`
	PublicKey       interface{} `json:"-"`
	SchemaVersion   string      `json:"schemaVersion,omitempty"`
}

type SignedRequestBody struct {
	RequestBody string `json:"requestBody"`
}