trust

type Entry struct {
	Project     string    `json:"project"`
	Site        string    `json:"site"`
	Fingerprint string    `json:"fingerprint"`
	CommonName  string    `json:"common_name,omitempty"`
	CertPath    string    `json:"cert_path"`
	KeyPath     string    `json:"key_path,omitempty"`
	Label       string    `json:"label"`
	Locations   []string  `json:"locations"`
	AddedAt     time.Time `json:"added_at"`
}

type NSSStatus struct {
	FirefoxFound    bool
	CertutilMissing bool
}

type Options struct {
	// TrustSystem (Linux) toggles writing to /usr/local/share/ca-certificates
	// and running `sudo update-ca-certificates`. Off by default because it
	// requires sudo.
	TrustSystem bool
	// DisableNSS skips Firefox NSS profile updates even when certutil is
	// available. Mostly useful for tests.
	DisableNSS bool
}

type RevokeOutcome struct {
	Site    string
	Cleaned []string
	Err     error
	ErrHint string
}

type SiteInput struct {
	Project      string
	Site         string
	InstanceName string
	BaseDir      string
	CertPEM      []byte
	// KeyPEM, when non-empty, is written to <ExportDir>/<Site>.key with 0o600.
	// When empty, any previously exported key file at that path is removed.
	KeyPEM []byte
}

type SiteOutcome struct {
	Site        string
	Verb        string
	Locations   []string
	NSS         NSSStatus
	KeyExported bool
	Err         error
	ErrHint     string
}

type State struct {
	Entries []Entry `json:"entries"`
}

type Store interface {
	// Trust adds the cert. Idempotent: re-running against an
	// already-trusted cert should succeed without error.
	Trust(input TrustInput) (TrustResult, error)
	// Untrust removes the cert from the locations recorded at trust time.
	// It returns the list of locations actually cleaned. Missing entries
	// are skipped silently.
	Untrust(input TrustInput, locations []string) ([]string, error)
	// Verify classifies each recorded location as present, missing, or
	// unknown. Used to detect drift between recorded state and reality
	// (e.g. user manually deleted from keychain).
	Verify(input TrustInput, locations []string) (VerifyResult, error)
}

type TrustInput struct {
	// CertPath is an absolute path to the PEM-encoded certificate already
	// present on disk. Stores that need a file (e.g. macOS `security`,
	// `certutil -i`) read it from here.
	CertPath string
	// CertPEM is the same content as the file at CertPath. Provided so
	// callers don't have to re-read the file.
	CertPEM []byte
	// Fingerprint is the hex-encoded SHA-256 of the DER bytes; used as a
	// stable identifier for state tracking and verification.
	Fingerprint string
	// Label is a human-readable name used for keychain entries and NSS
	// nicknames, e.g. "trellis: example.com".
	Label string
}

type TrustResult struct {
	Locations []string
	NSS       NSSStatus
}

type VerifyResult struct {
	Present []string
	Missing []string
	Unknown []string
}