client

type Client interface {
	SyncUpdates(ctx context.Context, cachedEntries map[string]*common.RegistrationEntry, cachedBundles map[string]*common.Bundle) (SyncStats, error)
	RenewSVID(ctx context.Context, csr []byte) (*X509SVID, error)
	NewX509SVIDs(ctx context.Context, csrs map[string][]byte) (map[string]*X509SVID, error)
	NewJWTSVID(ctx context.Context, entryID string, audience []string, hasCacheHit bool) (*JWTSVID, spiffeid.ID, error)
	NewWITSVIDs(ctx context.Context, publicKeys map[string]crypto.PublicKey, signatureAlgorithm string) (map[string]*WITSVID, error)
	PostStatus(ctx context.Context, agentVersion string) error

	// Release releases any resources that were held by this Client, if any.
	Release()
}

type Config struct {
	Addr        string
	Log         logrus.FieldLogger
	TrustDomain spiffeid.TrustDomain
	// KeysAndBundle is a callback that must return the keys and bundle used by the client
	// to connect via mTLS to Addr.
	KeysAndBundle func() ([]*x509.Certificate, crypto.Signer, []*x509.Certificate)

	// RotMtx is used to prevent the creation of new connections during SVID rotations
	RotMtx *sync.RWMutex

	// TLSPolicy determines the post-quantum-safe policy to apply to all TLS connections.
	TLSPolicy tlspolicy.Policy

	// LoadBalancingConfig is an optional, opaque payload used as the
	// loadBalancingConfig field of the gRPC service config.
	LoadBalancingConfig string
}

type JWTSVID struct {
	Token     string
	IssuedAt  time.Time
	ExpiresAt time.Time
}

type ServerClientConfig struct {
	// Address is the SPIRE server address
	Address string

	TrustDomain spiffeid.TrustDomain

	// GetBundle is a required callback that returns the current trust bundle
	// for used to authenticate the server certificate.
	GetBundle func() []*x509.Certificate

	// GetAgentCertificate is an optional callback used to return the agent
	// certificate to present to the server during the TLS handshake.
	GetAgentCertificate func() *tls.Certificate

	// TLSPolicy determines the post-quantum-safe policy to apply to all TLS connections.
	TLSPolicy tlspolicy.Policy

	// LoadBalancingConfig is an optional, opaque payload used as the
	// loadBalancingConfig field of the gRPC service config. If empty, the
	// default load balancing configuration is used.
	LoadBalancingConfig string
	// contains filtered or unexported fields
}

type SyncBundlesStats struct {
	Total int
}

type SyncEntriesStats struct {
	Total   int
	Missing int
	Stale   int
	Dropped int
}

type SyncStats struct {
	Entries SyncEntriesStats
	Bundles SyncBundlesStats
}

type Update struct {
	Entries map[string]*common.RegistrationEntry
	Bundles map[string]*common.Bundle
}

type WITSVID struct {
	Token     string
	IssuedAt  time.Time
	ExpiresAt time.Time
}

type X509SVID struct {
	CertChain []byte
	ExpiresAt int64
}