keystore

type Admin interface {
	// CreateKeys creates multiple keys in a single atomic operation.
	// The response preserves the order of the keys in the request.
	// Returns ErrKeyAlreadyExists if any key name already exists,
	// ErrInvalidKeyName if any key name is invalid,
	// ErrUnsupportedKeyType if any key type is not supported.
	CreateKeys(ctx context.Context, req CreateKeysRequest) (CreateKeysResponse, error)

	// DeleteKeys deletes multiple keys in a single atomic operation.
	// Returns ErrKeyNotFound if any key does not exist.
	DeleteKeys(ctx context.Context, req DeleteKeysRequest) (DeleteKeysResponse, error)

	// ImportKeys imports multiple encrypted keys in a single atomic operation.
	// Keys can be renamed during import using NewKeyName.
	// Returns ErrKeyAlreadyExists if a key with the target name exists,
	// ErrInvalidKeyName if the target name is invalid.
	ImportKeys(ctx context.Context, req ImportKeysRequest) (ImportKeysResponse, error)

	// ExportKeys exports multiple keys in encrypted format.
	// Each key is encrypted using the parameters specified in the request.
	// Returns ErrKeyNotFound if any key does not exist.
	ExportKeys(ctx context.Context, req ExportKeysRequest) (ExportKeysResponse, error)

	// SetMetadata updates metadata for multiple keys in a single atomic operation.
	// Returns ErrKeyNotFound if any key does not exist.
	SetMetadata(ctx context.Context, req SetMetadataRequest) (SetMetadataResponse, error)

	// RenameKey renames an existing key.
	// Returns ErrKeyNotFound if the old key name does not exist,
	// ErrKeyAlreadyExists if the new key name exists,
	// ErrInvalidKeyName if the new key name is invalid.
	RenameKey(ctx context.Context, req RenameKeyRequest) (RenameKeyResponse, error)
}

type CoreKeystore struct {
	// contains filtered or unexported fields
}

type CreateKeyRequest struct {
	KeyName string
	KeyType KeyType
}

type CreateKeyResponse struct {
	KeyInfo KeyInfo
}

type CreateKeysRequest struct {
	Keys []CreateKeyRequest
}

type CreateKeysResponse struct {
	Keys []CreateKeyResponse
}

type DecryptRequest struct {
	KeyName       string
	EncryptedData []byte
}

type DecryptResponse struct {
	Data []byte
}

type DeleteKeysRequest struct {
	KeyNames []string
}

type DeleteKeysResponse struct{}

type DeriveSharedSecretRequest struct {
	KeyName      string
	RemotePubKey []byte
}

type DeriveSharedSecretResponse struct {
	SharedSecret []byte
}

type EncryptRequest struct {
	RemoteKeyType KeyType
	RemotePubKey  []byte
	Data          []byte
}

type EncryptResponse struct {
	EncryptedData []byte
}

type EncryptionParams struct {
	Password     string
	ScryptParams ScryptParams
}

type Encryptor interface {
	Encrypt(ctx context.Context, req EncryptRequest) (EncryptResponse, error)
	Decrypt(ctx context.Context, req DecryptRequest) (DecryptResponse, error)
	// DeriveSharedSecret: Derives a shared secret between the key specified
	// and the remote public key. WARNING: Using the shared secret should only be used directly in
	// cases where very custom encryption schemes are needed and you know
	// exactly what you are doing.
	DeriveSharedSecret(ctx context.Context, req DeriveSharedSecretRequest) (DeriveSharedSecretResponse, error)
}

type ExportKeyParam struct {
	KeyName string
	Enc     EncryptionParams
}

type ExportKeyResponse struct {
	KeyName string
	Data    []byte
}

type ExportKeysRequest struct {
	Keys []ExportKeyParam
}

type ExportKeysResponse struct {
	Keys []ExportKeyResponse
}

type FileStorage struct {
	// contains filtered or unexported fields
}

type GetKeyRequest struct {
	KeyName string
}

type GetKeyResponse struct {
	KeyInfo KeyInfo
}

type GetKeysRequest struct {
	KeyNames []string
}

type GetKeysResponse struct {
	Keys []GetKeyResponse
}

type ImportKeyRequest struct {
	NewKeyName string
	Data       []byte
	Password   string
}

type ImportKeysRequest struct {
	Keys []ImportKeyRequest
}

type ImportKeysResponse struct{}

type KeyInfo struct {
	Name      string
	KeyType   KeyType
	CreatedAt time.Time
	PublicKey []byte
	Metadata  []byte
}

type KeyPath []string

type KeyType string

type KeyTypeList []KeyType

type Keystore interface {
	Admin
	Reader
	Signer
	Encryptor
}

type MemoryStorage struct {
	// contains filtered or unexported fields
}

type Option func(*keystore)

type Reader interface {
	GetKeys(ctx context.Context, req GetKeysRequest) (GetKeysResponse, error)
}

type RenameKeyRequest struct {
	OldName string
	NewName string
}

type RenameKeyResponse struct{}

type ScryptParams struct {
	N int
	P int
}

type SetMetadataRequest struct {
	Updates []SetMetadataUpdate
}

type SetMetadataResponse struct{}

type SetMetadataUpdate struct {
	KeyName  string
	Metadata []byte
}

type SignRequest struct {
	KeyName string
	Data    []byte
}

type SignResponse struct {
	Signature []byte
}

type Signer interface {
	Sign(ctx context.Context, req SignRequest) (SignResponse, error)
	Verify(ctx context.Context, req VerifyRequest) (VerifyResponse, error)
}

type Storage interface {
	GetEncryptedKeystore(ctx context.Context) ([]byte, error)
	// PutEncryptedKeystore must atomically replace the entire encrypted keystore.
	PutEncryptedKeystore(ctx context.Context, encryptedKeystore []byte) error
}

type UnimplementedAdmin struct{}

type UnimplementedEncryptor struct{}

type UnimplementedKeystore struct {
	UnimplementedAdmin
	UnimplementedReader
	UnimplementedSigner
	UnimplementedEncryptor
}

type UnimplementedReader struct{}

type UnimplementedSigner struct{}

type VerifyRequest struct {
	KeyType   KeyType
	PublicKey []byte
	Data      []byte
	Signature []byte
}

type VerifyResponse struct {
	Valid bool
}