internal

type BundleConfig struct {
	CommonNames []string       `yaml:"commonNames"`
	BundleName  string         `yaml:"bundleName"`
	Subject     *SubjectConfig `yaml:"subject,omitempty"`
}

type BundlesYAML struct {
	DefaultSubject *SubjectConfig `yaml:"defaultSubject,omitempty"`
	Bundles        []BundleConfig `yaml:"bundles"`
}

type CSROptions struct {
	TemplatePath string // JSON template file
	CertPath     string // PEM cert as template
	CSRPath      string // PEM CSR as template

	KeyPath   string // Existing key (PEM)
	Algorithm string // rsa, ecdsa, ed25519 (default: ecdsa)
	Bits      int    // RSA bits (default: 4096)
	Curve     string // ECDSA curve (default: P-256)

	OutPath   string   // Output directory (default: ".")
	Passwords []string // Passwords for encrypted keys
}

type CSRResult struct {
	CSRPEM  string
	KeyPEM  string // empty if existing key was provided
	CSRFile string // empty in stdout mode
	KeyFile string // empty in stdout mode
}

type CertificateRecord struct {
	SerialNumber           string         `db:"serial_number"`
	SubjectKeyIdentifier   string         `db:"subject_key_identifier"`
	AuthorityKeyIdentifier string         `db:"authority_key_identifier"`
	CertType               string         `db:"cert_type"`
	KeyType                string         `db:"key_type"`
	Expiry                 time.Time      `db:"expiry"`
	PEM                    string         `db:"pem"`
	NotBefore              *time.Time     `db:"not_before"`
	MetadataJSON           types.JSONText `db:"metadata"`
	SANsJSON               types.JSONText `db:"sans"`
	CommonName             sql.NullString `db:"common_name"`
	BundleName             string         `db:"bundle_name"`
}

type ChainCert struct {
	Subject string
	Expiry  string
	SKI     string
	IsRoot  bool
}

type Config struct {
	InputPath      string
	Passwords      []string
	DB             *DB
	ExportBundles  bool
	ForceExport    bool
	BundleConfigs  []BundleConfig
	OutDir         string
	IncludeExpired bool
}

type ContainerContents struct {
	Leaf       *x509.Certificate
	Key        crypto.PrivateKey
	ExtraCerts []*x509.Certificate
}

type DB struct {
	*sqlx.DB
}

type InspectResult struct {
	Type        string   `json:"type"`
	Subject     string   `json:"subject,omitempty"`
	Issuer      string   `json:"issuer,omitempty"`
	Serial      string   `json:"serial,omitempty"`
	NotBefore   string   `json:"not_before,omitempty"`
	NotAfter    string   `json:"not_after,omitempty"`
	CertType    string   `json:"cert_type,omitempty"`
	KeyAlgo     string   `json:"key_algorithm,omitempty"`
	KeySize     string   `json:"key_size,omitempty"`
	SANs        []string `json:"sans,omitempty"`
	SHA256      string   `json:"sha256_fingerprint,omitempty"`
	SHA1        string   `json:"sha1_fingerprint,omitempty"`
	SKI         string   `json:"subject_key_id,omitempty"`
	SKILegacy   string   `json:"subject_key_id_sha1,omitempty"`
	AKI         string   `json:"authority_key_id,omitempty"`
	SigAlg      string   `json:"signature_algorithm,omitempty"`
	KeyType     string   `json:"key_type,omitempty"`
	CSRSubject  string   `json:"csr_subject,omitempty"`
	CSRDNSNames []string `json:"csr_dns_names,omitempty"`
}

type K8sMetadata struct {
	Name        string            `yaml:"name"`
	Annotations map[string]string `yaml:"annotations,omitempty"`
}

type K8sSecret struct {
	APIVersion string            `yaml:"apiVersion"`
	Kind       string            `yaml:"kind"`
	Type       string            `yaml:"type"`
	Metadata   K8sMetadata       `yaml:"metadata"`
	Data       map[string]string `yaml:"data"`
}

type KeyRecord struct {
	SubjectKeyIdentifier string `db:"subject_key_identifier"`
	KeyType              string `db:"key_type"`
	BitLength            int    `db:"bit_length"`
	PublicExponent       int    `db:"public_exponent"`
	Modulus              string `db:"modulus"`
	Curve                string `db:"curve"`
	KeyData              []byte `db:"key_data"`
}

type KeygenOptions struct {
	Algorithm string
	Bits      int
	Curve     string
	OutPath   string
	CN        string
	SANs      []string
}

type KeygenResult struct {
	KeyPEM  string
	PubPEM  string
	CSRPEM  string // empty if no CSR generated
	KeyFile string // empty in stdout mode
	PubFile string // empty in stdout mode
	CSRFile string // empty in stdout mode
}

type ScanSummary struct {
	Roots         int
	Intermediates int
	Leaves        int
	Keys          int
	Matched       int // keys that have a matching certificate
}

type SubjectConfig struct {
	Country            []string `yaml:"country,omitempty"`            // C
	Province           []string `yaml:"province,omitempty"`           // ST
	Locality           []string `yaml:"locality,omitempty"`           // L
	Organization       []string `yaml:"organization,omitempty"`       // O
	OrganizationalUnit []string `yaml:"organizationalUnit,omitempty"` // OU
}

type VerifyInput struct {
	Cert           *x509.Certificate
	Key            crypto.PrivateKey
	ExtraCerts     []*x509.Certificate
	CustomRoots    []*x509.Certificate
	CheckKeyMatch  bool
	CheckChain     bool
	ExpiryDuration time.Duration
	TrustStore     string
}

type VerifyResult struct {
	Subject     string      `json:"subject"`
	SANs        []string    `json:"sans,omitempty"`
	NotAfter    string      `json:"not_after"`
	SKI         string      `json:"ski,omitempty"`
	KeyMatch    *bool       `json:"key_match,omitempty"`
	KeyMatchErr string      `json:"key_match_error,omitempty"`
	KeyInfo     string      `json:"key_info,omitempty"`
	ChainValid  *bool       `json:"chain_valid,omitempty"`
	ChainErr    string      `json:"chain_error,omitempty"`
	Chain       []ChainCert `json:"chain,omitempty"`
	Expiry      *bool       `json:"expires_within,omitempty"`
	ExpiryInfo  string      `json:"expiry_info,omitempty"`
	Errors      []string    `json:"errors,omitempty"`
}