kms

type AWSProvider struct {
	// contains filtered or unexported fields
}

type AWSProviderConfig struct {
	KeyID                 string
	Region                string
	Endpoint              string
	RoleARN               string
	RoleSessionName       string
	AccessKey             string
	SecretKey             string
	SessionToken          string
	SharedCredsFilename   string
	SharedCredsProfile    string
	WebIdentityTokenFile  string
	DisallowEnvCredential bool
}

type AuditArchiver struct {
	// contains filtered or unexported fields
}

type AuditArchiverConfig struct {
	LocalPath  string
	SignEvents bool
	SignKey    []byte
}

type AuditEvent struct {
	EventType  string                 `json:"event_type"`
	KeyURI     string                 `json:"key_uri,omitempty"`
	Principal  string                 `json:"principal,omitempty"`
	Timestamp  time.Time              `json:"timestamp"`
	Status     string                 `json:"status"`
	ErrorCode  string                 `json:"error_code,omitempty"`
	Metadata   map[string]interface{} `json:"metadata,omitempty"`
	Signature  string                 `json:"signature,omitempty"`
	ProviderID string                 `json:"provider_id,omitempty"`
}

type AuditSigner struct {
	// contains filtered or unexported fields
}

type AzureProvider struct {
	// contains filtered or unexported fields
}

type AzureProviderConfig struct {
	VaultName             string
	KeyName               string
	TenantID              string
	ClientID              string
	ClientSecret          string
	Environment           string
	Resource              string
	DisallowEnvCredential bool
}

type DataKey struct {
	KeyURI     string
	Ciphertext []byte
	Plaintext  []byte
	Version    uint32
	CreatedAt  time.Time
	ExpiresAt  time.Time
	Algorithm  string
}

type DecryptOpts struct {
	KeyURI string
}

type FactoryConfig struct {
	Provider   string
	KeyURI     string
	MasterKey  []byte
	Archiver   *AuditArchiver
	ProviderID string

	AWS   AWSProviderConfig
	Azure AzureProviderConfig
	GCP   GCPProviderConfig
}

type GCPProvider struct {
	// contains filtered or unexported fields
}

type GCPProviderConfig struct {
	Project         string
	Location        string
	KeyRing         string
	KeyName         string
	CredentialsFile string
}

type KeyGenOpts struct {
	Algorithm string
	TTL       time.Duration
	Label     string
}

type KeyMetadata struct {
	KeyURI     string
	Version    uint32
	Algorithm  string
	CreatedAt  time.Time
	ExpiresAt  time.Time
	Provider   string
	FIPSLevel  string
	Properties map[string]interface{}
}

type KeyProvider interface {
	GenerateDataKey(ctx context.Context, opts KeyGenOpts) (*DataKey, error)
	DecryptDataKey(ctx context.Context, encryptedKey []byte, opts DecryptOpts) ([]byte, error)
	RotateDataKey(ctx context.Context, encryptedKey []byte, opts RotateOpts) (*DataKey, error)
	GetKeyMetadata(ctx context.Context, keyURI string) (*KeyMetadata, error)
	SignAuditEvent(ctx context.Context, event AuditEvent) error
	Close(ctx context.Context) error
}

type LocalConfig struct {
	MasterKey []byte
	KeyURI    string
}

type LocalProvider struct {
	// contains filtered or unexported fields
}

type NopAuditProvider struct{}

type RotateOpts struct {
	KeyURI string
	Label  string
	TTL    time.Duration
}