spireapi

type BundleClient interface {
	// MintX509SVID mints an X509-SVID
	GetBundle(ctx context.Context) (*spiffebundle.Bundle, error)
}

type BundleEndpointProfile interface {
	Name() string
	Equal(BundleEndpointProfile) bool
	// contains filtered or unexported methods
}

type Client interface {
	EntryClient
	TrustDomainClient
	SVIDClient
	BundleClient
	io.Closer
}

type Entry struct {
	ID            string
	SPIFFEID      spiffeid.ID
	ParentID      spiffeid.ID
	Selectors     []Selector
	X509SVIDTTL   time.Duration
	FederatesWith []spiffeid.TrustDomain
	Admin         bool
	Downstream    bool
	DNSNames      []string
}

type EntryClient interface {
	ListEntries(ctx context.Context) ([]Entry, error)
	CreateEntries(ctx context.Context, entries []Entry) ([]Status, error)
	UpdateEntries(ctx context.Context, entries []Entry) ([]Status, error)
	DeleteEntries(ctx context.Context, entryIDs []string) ([]Status, error)
}

type FederationRelationship struct {
	TrustDomain           spiffeid.TrustDomain
	BundleEndpointURL     string
	BundleEndpointProfile BundleEndpointProfile
	TrustDomainBundle     *spiffebundle.Bundle
}

type HTTPSSPIFFEProfile struct {
	EndpointSPIFFEID spiffeid.ID
}

type HTTPSWebProfile struct{}

type JWTKey struct {
	KeyID     string
	PublicKey crypto.PublicKey
	ExpiresAt time.Time
}

type SVIDClient interface {
	// MintX509SVID mints an X509-SVID
	MintX509SVID(ctx context.Context, params X509SVIDParams) (*X509SVID, error)
}

type Selector struct {
	Type  string
	Value string
}

type Status struct {
	Code    codes.Code
	Message string
}

type TrustDomainClient interface {
	ListFederationRelationships(ctx context.Context) ([]FederationRelationship, error)
	CreateFederationRelationships(ctx context.Context, federationRelationships []FederationRelationship) ([]Status, error)
	UpdateFederationRelationships(ctx context.Context, federationRelationships []FederationRelationship) ([]Status, error)
	DeleteFederationRelationships(ctx context.Context, tds []spiffeid.TrustDomain) ([]Status, error)
}

type X509SVID struct {
	// ID is the SPIFFE ID of the X509-SVID.
	ID spiffeid.ID

	// Key is the private key of the X509-SVID
	Key crypto.Signer

	// CertChain contains the X509-SVID and any intermediates required to
	// chain back to trusted root in the trust domain bundle. The X509-SVID
	// is the first certificate in the chain.
	CertChain []*x509.Certificate

	// ExpiresAt contains the expiration time of the X509-SVID.
	ExpiresAt time.Time
}

type X509SVIDParams struct {
	// Key is the X509-SVID private key.
	Key crypto.Signer

	// ID is the SPIFFE ID of the X509-SVID. Required.
	ID spiffeid.ID

	// DNSNames are optional DNS SANs to add to the X509-SVID. Optional.
	DNSNames []string

	// Subject is the Subject of the X509-SVID. Optional.
	Subject pkix.Name

	// TTL is the requested time-to-live. The actual TTL may be smaller than
	// requested. Optional. If unset, the TTL is at most one hour.
	TTL time.Duration
}